Analysis

  • max time kernel
    170s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 01:56

General

  • Target

    ea3a2f4ccb1575a21c790e37aca831bed210b9860eb72dad7879d8bea7b99dd7.exe

  • Size

    527KB

  • MD5

    e0804b5d4735af8595cf296545bb5f01

  • SHA1

    05d5089042faf5a4661b53ad6a3147d7d457820d

  • SHA256

    ea3a2f4ccb1575a21c790e37aca831bed210b9860eb72dad7879d8bea7b99dd7

  • SHA512

    961bcfe8ee675408e896a53252ff6389ca843e75622685cbb75fe55c290f136c4b1724c074cce86883f16c56491facbe6a82afd11dace6db6799a72b202e569b

Malware Config

Extracted

Family

raccoon

Botnet

42069a99036f7acbe85c9bc67fe3207cd01fb3fc

Attributes
url4cnc
https://telete.in/jagressor_kz
rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload ⋅ 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea3a2f4ccb1575a21c790e37aca831bed210b9860eb72dad7879d8bea7b99dd7.exe
    "C:\Users\Admin\AppData\Local\Temp\ea3a2f4ccb1575a21c790e37aca831bed210b9860eb72dad7879d8bea7b99dd7.exe"
    PID:2588

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/2588-130-0x0000000005149000-0x0000000005199000-memory.dmp
                          • memory/2588-131-0x00000000050A0000-0x0000000005130000-memory.dmp
                          • memory/2588-132-0x0000000000400000-0x0000000004DFE000-memory.dmp