Analysis
- max time kernel
154s - max time network
130s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
03/02/2022, 07:31
General
- Target 42bfdee70acf93f972b741475db4ca6f.exe
- Size 1.7MB
- Sample220203-jcd6paeacl
- SHA256 c4ffe6c2f699fd77bdf6b7b7f49e3ba3691275585292eae1c600d997d6a9c0ee
Malware Config
Extracted
-
raccoon
-
1.8.5
-
1d78f9f6c63eda0cee41621b90faf161e3d09c63
-
url4cnc
http://188.166.1.115/firstford15bro
http://91.219.236.139/firstford15bro
http://194.180.174.147/firstford15bro
http://185.3.95.153/firstford15bro
http://185.163.204.22/firstford15bro
http://185.163.47.176/firstford15bro
https://t.me/firstford15bro
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42bfdee70acf93f972b741475db4ca6f.exe"C:\Users\Admin\AppData\Local\Temp\42bfdee70acf93f972b741475db4ca6f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1616-54-0x0000000001DF0000-0x0000000001E3C000-memory.dmp
memory/1616-55-0x00000000002D0000-0x000000000045B000-memory.dmp
memory/1616-56-0x00000000002D0000-0x000000000045B000-memory.dmp
memory/1616-57-0x0000000074F01000-0x0000000074F03000-memory.dmp
memory/1616-58-0x00000000002D0000-0x000000000045B000-memory.dmp
memory/1616-60-0x0000000076490000-0x000000007653C000-memory.dmp
memory/1616-62-0x0000000074E50000-0x0000000074E97000-memory.dmp
memory/1616-64-0x0000000075B50000-0x0000000075CAC000-memory.dmp
memory/1616-65-0x0000000074590000-0x00000000745DF000-memory.dmp
memory/1616-66-0x00000000745E0000-0x0000000074638000-memory.dmp
memory/1616-67-0x0000000076420000-0x000000007642C000-memory.dmp
memory/1616-70-0x0000000074570000-0x0000000074587000-memory.dmp
memory/1616-69-0x0000000074560000-0x000000007456B000-memory.dmp
memory/1616-68-0x0000000074D30000-0x0000000074E4D000-memory.dmp
memory/1616-71-0x0000000074540000-0x0000000074557000-memory.dmp
memory/1616-72-0x00000000743B0000-0x0000000074540000-memory.dmp
memory/1616-73-0x0000000074EA0000-0x0000000074EF7000-memory.dmp
memory/1616-74-0x0000000076450000-0x0000000076485000-memory.dmp
memory/1616-75-0x0000000074B50000-0x0000000074B5C000-memory.dmp
memory/1616-76-0x00000000760A0000-0x00000000760B9000-memory.dmp
memory/1616-78-0x0000000000170000-0x0000000000172000-memory.dmp
memory/1616-79-0x00000000742E0000-0x0000000074324000-memory.dmp