Analysis
-
max time kernel
81s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/06/2022, 03:19
General
-
Target
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe
-
Size
7.5MB
-
MD5
54e884a1b12fec5e6beaa3a3fc431bee
-
SHA1
e7f866afe8e34c722f8dbc5057e47856e37fa0ff
-
SHA256
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d
-
SHA512
863de15037dd1ef165387c3f8a7aaa4526aba11e2fbc4ef1e15c3b2f7c768ca154c35724b5ab5e8ad6a37e30959d19cb09e7d0a63fc9f78f730a00a79307c702
Score
10/10
Malware Config
Signatures
-
Raccoon ver2 2 IoCs
Raccoon ver2.
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe"C:\Users\Admin\AppData\Local\Temp\494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
7.5MB
-
Filesize
7.5MB