Analysis
- max time kernel
4294182s - max time network
124s - platform
windows7_x64 - resource
win7-20220311-en - submitted
13/03/2022, 21:43
General
- Target SecuriteInfo.com.Packed-GDTD57D3D46AFC7.11004.exe
- Size 517KB
- Sample220313-1kxfnsccck
- SHA256 95ff9f24e1ea61cff965288ab817e57d8ea0a18a6669606828f503df8fd39fe8
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
d7ce4d2837ba5349afb5f48e90638edf69cc105c
Attributes
-
url4cnc
http://185.163.204.81/hkpyagain
http://194.180.191.33/hkpyagain
http://174.138.11.98/hkpyagain
http://194.180.191.44/hkpyagain
http://91.219.236.120/sheinl
https://t.me/hkpyagain
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
- suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Packed-GDTD57D3D46AFC7.11004.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Packed-GDTD57D3D46AFC7.11004.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 4162⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1996-54-0x000000000058F000-0x00000000005DF000-memory.dmp
memory/1996-55-0x0000000074C61000-0x0000000074C63000-memory.dmp
memory/1996-56-0x000000000058F000-0x00000000005DF000-memory.dmp
memory/1996-57-0x00000000002E0000-0x0000000000372000-memory.dmp
memory/1996-58-0x0000000000400000-0x00000000004B2000-memory.dmp