Analysis
- max time kernel
131s - max time network
131s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
20/01/2022, 12:17
General
- Target bd1deb82ba2140eae3299f419783bab0.exe
- Size 670KB
- Sample220120-pf2daahhhj
- SHA256 b31474d8c16181a103a6ac36d9277eb7ac5dbb7261cfa74f82adbc8b2d06d3fa
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Version
-
1.8.5
Botnet
-
470193d69fd872b73819c5e70dc68242c10ccbce
Attributes
-
url4cnc
http://185.163.204.22/capibar
http://178.62.113.205/capibar
https://t.me/capibar
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1deb82ba2140eae3299f419783bab0.exe"C:\Users\Admin\AppData\Local\Temp\bd1deb82ba2140eae3299f419783bab0.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1720-54-0x00000000002F0000-0x0000000000361000-memory.dmp
memory/1720-55-0x0000000000620000-0x00000000006B3000-memory.dmp
memory/1720-56-0x0000000000400000-0x0000000000619000-memory.dmp
memory/1720-57-0x00000000006E0000-0x00000000007C0000-memory.dmp
memory/1720-59-0x0000000075601000-0x0000000075603000-memory.dmp
memory/1720-58-0x0000000000400000-0x0000000000619000-memory.dmp
memory/1720-60-0x0000000001F50000-0x0000000001FE2000-memory.dmp
memory/1720-61-0x0000000000400000-0x0000000000619000-memory.dmp