Analysis
- max time kernel
119s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
20/02/2022, 14:06
General
- Target 8603e13cdf6585cc8c0c444f6f1c5206.exe
- Size 544KB
- Sample220220-ref23acfan
- SHA256 019d041219a518b5ca40ba5547cf5f8b80fcedce2ee8f791f02d9d9acda7388f
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
e50c949ecf0380ef03a3368f13619264294662b6
Attributes
-
url4cnc
http://185.163.204.119/wavesf
http://206.189.100.203/wavesf
http://194.180.191.234/wavesf
http://185.163.204.216/wavesf
http://139.162.157.205/wavesf
https://t.me/wavesf
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
- Drops file in Windows directory 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8603e13cdf6585cc8c0c444f6f1c5206.exe"C:\Users\Admin\AppData\Local\Temp\8603e13cdf6585cc8c0c444f6f1c5206.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/524-133-0x0000026733760000-0x0000026733770000-memory.dmp
memory/524-134-0x0000026733D20000-0x0000026733D30000-memory.dmp
memory/524-135-0x00000267363E0000-0x00000267363E4000-memory.dmp
memory/4000-130-0x00000000023E0000-0x0000000002430000-memory.dmp
memory/4000-131-0x0000000002430000-0x00000000024C2000-memory.dmp
memory/4000-132-0x0000000000400000-0x0000000000493000-memory.dmp