Analysis
- max time kernel
4294182s - max time network
132s - platform
windows7_x64 - resource
win7-20220310-en - submitted
15/03/2022, 14:29
General
- Target e76a72943fd90042a8e1e3df2b5d4280.exe
- Size 552KB
- Sample220315-rtknssbaal
- SHA256 5e2c211900e145c9aad6d6970858eebbadf07ea9cfb517deae7e5edc66e41cb4
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
d7ce4d2837ba5349afb5f48e90638edf69cc105c
Attributes
-
url4cnc
http://185.163.204.81/hkpyagain
http://194.180.191.33/hkpyagain
http://174.138.11.98/hkpyagain
http://194.180.191.44/hkpyagain
http://91.219.236.120/sheinl
https://t.me/hkpyagain
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
Processes
-
C:\Users\Admin\AppData\Local\Temp\e76a72943fd90042a8e1e3df2b5d4280.exe"C:\Users\Admin\AppData\Local\Temp\e76a72943fd90042a8e1e3df2b5d4280.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1076-54-0x00000000002ED000-0x000000000033E000-memory.dmp
memory/1076-55-0x0000000076861000-0x0000000076863000-memory.dmp
memory/1076-56-0x00000000002ED000-0x000000000033E000-memory.dmp
memory/1076-57-0x0000000001CF0000-0x0000000001D82000-memory.dmp
memory/1076-58-0x0000000000400000-0x00000000004B5000-memory.dmp