Analysis
-
max time kernel
45s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 03:44
General
-
Target
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
-
Size
7.2MB
-
MD5
fc0c8c94d1c1463033a52735b09b8543
-
SHA1
a389c3e50ad4126db350a8a152a328c6940a45a8
-
SHA256
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe
-
SHA512
26ff92befc374874331268ba9f39b2cc3b88dd0d102e6f8c5c7fb1147a09f92d5ba039f37a20b7d9a616c5826ccf72e332287c9787ec39e46003a28896a338ce
Score
10/10
Malware Config
Signatures
-
Raccoon ver2 3 IoCs
Raccoon ver2.
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe"C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
-
Filesize
8KB
-
Filesize
11.3MB
-
Filesize
11.3MB