Analysis
- max time kernel
4294182s - max time network
129s - platform
windows7_x64 - resource
win7-20220223-en - submitted
08/03/2022, 17:11
General
- Target 64b3f23bb2614ed52b258231ea06dd1d.exe
- Size 784KB
- Sample220308-vqaafaheb2
- SHA256 bbfbaa2a94c27178182d0602e7939539dd4af0f025c252a87f1cb623b6dd188b
Malware Config
Extracted
-
raccoon
-
705af3b595fd042d2883e0f8c35ae4347af5fa9b
-
url4cnc
http://85.159.212.113/brun09s
http://185.163.204.81/brun09s
http://194.180.191.33/brun09s
http://174.138.11.98/brun09s
http://194.180.191.44/brun09s
http://91.219.236.120/brun09s
https://t.me/brun09s
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\64b3f23bb2614ed52b258231ea06dd1d.exe"C:\Users\Admin\AppData\Local\Temp\64b3f23bb2614ed52b258231ea06dd1d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1948-54-0x00000000759B1000-0x00000000759B3000-memory.dmp
memory/1948-55-0x00000000002A0000-0x00000000004DA000-memory.dmp
memory/1948-56-0x00000000002A0000-0x00000000004DA000-memory.dmp
memory/1948-57-0x00000000000F0000-0x00000000000F2000-memory.dmp
memory/1948-58-0x0000000000230000-0x0000000000279000-memory.dmp
memory/1948-59-0x00000000002A0000-0x00000000004DA000-memory.dmp
memory/1948-60-0x00000000002A0000-0x00000000004DA000-memory.dmp
memory/1948-61-0x0000000000100000-0x0000000000102000-memory.dmp