Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
22/01/2022, 14:04
General
- Target 1f0b449499b8811d74e99726d337fb91.exe
- Size 614KB
- Sample220122-rdbe7abfer
- SHA256 e438f74e71aa80712289eaac851a59a481b24e46ba5d607e3cd42aeea6129bd8
Malware Config
Extracted
-
raccoon
-
1.8.5
-
1bc6116182dfd33bce1052fe9bb0415968161030
-
url4cnc
http://91.219.236.133/capibar
http://194.180.174.145/capibar
http://188.166.1.115/capibar
http://91.219.236.139/capibar
http://194.180.174.147/capibar
http://185.3.95.153/capibar
http://185.163.204.22/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f0b449499b8811d74e99726d337fb91.exe"C:\Users\Admin\AppData\Local\Temp\1f0b449499b8811d74e99726d337fb91.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1608-54-0x0000000000220000-0x0000000000287000-memory.dmp
memory/1608-55-0x00000000004A0000-0x0000000000527000-memory.dmp
memory/1608-56-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1608-57-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1608-58-0x0000000076C61000-0x0000000076C63000-memory.dmp
memory/1608-59-0x0000000000290000-0x00000000002E0000-memory.dmp
memory/1608-60-0x0000000000530000-0x00000000005C2000-memory.dmp
memory/1608-61-0x0000000000400000-0x00000000004A0000-memory.dmp