Analysis
-
max time kernel
132s -
max time network
317s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-06-2022 03:44
Static task
static1
Behavioral task
behavioral1
Sample
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
Resource
win10-20220414-en
General
-
Target
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
-
Size
7.2MB
-
MD5
fc0c8c94d1c1463033a52735b09b8543
-
SHA1
a389c3e50ad4126db350a8a152a328c6940a45a8
-
SHA256
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe
-
SHA512
26ff92befc374874331268ba9f39b2cc3b88dd0d102e6f8c5c7fb1147a09f92d5ba039f37a20b7d9a616c5826ccf72e332287c9787ec39e46003a28896a338ce
Malware Config
Signatures
-
Raccoon ver2 4 IoCs
Raccoon ver2.
Processes:
resource yara_rule behavioral2/memory/3896-135-0x00000000000A0000-0x0000000000BE6000-memory.dmp raccoon_v2 behavioral2/memory/3896-136-0x00000000000A0000-0x0000000000BE6000-memory.dmp raccoon_v2 behavioral2/memory/3896-142-0x00000000000A0000-0x0000000000BE6000-memory.dmp raccoon_v2 behavioral2/memory/3896-166-0x00000000000A0000-0x0000000000BE6000-memory.dmp raccoon_v2 -
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exepid Process 3896 ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe 3896 ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exepid Process 3896 ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe 3896 ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe"C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3896