Analysis
- max time kernel
130s - max time network
133s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
22/01/2022, 14:04
General
- Target 1f0b449499b8811d74e99726d337fb91.exe
- Size 614KB
- Sample220122-rdbe7abfer
- SHA256 e438f74e71aa80712289eaac851a59a481b24e46ba5d607e3cd42aeea6129bd8
Malware Config
Extracted
-
raccoon
-
1.8.5
-
1bc6116182dfd33bce1052fe9bb0415968161030
-
url4cnc
http://91.219.236.133/capibar
http://194.180.174.145/capibar
http://188.166.1.115/capibar
http://91.219.236.139/capibar
http://194.180.174.147/capibar
http://185.3.95.153/capibar
http://185.163.204.22/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f0b449499b8811d74e99726d337fb91.exe"C:\Users\Admin\AppData\Local\Temp\1f0b449499b8811d74e99726d337fb91.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3064-115-0x0000000000910000-0x0000000000977000-memory.dmp
memory/3064-116-0x00000000009F0000-0x0000000000A77000-memory.dmp
memory/3064-117-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3064-118-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3064-119-0x0000000000980000-0x00000000009D0000-memory.dmp
memory/3064-120-0x0000000000B10000-0x0000000000BA2000-memory.dmp
memory/3064-121-0x0000000000400000-0x00000000004A0000-memory.dmp