Analysis
-
max time kernel
104s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20220715-en -
submitted
16-07-2022 16:03
General
-
Target
065a30af4b949ed07c5c1761c7426f79.exe
-
Size
6.9MB
-
MD5
065a30af4b949ed07c5c1761c7426f79
-
SHA1
a3c706e73d278d6124c70d8cd0392f6c47f2205f
-
SHA256
a48ba6c3447ff9e85c9524ce4a90771735e5ca09c917b74fce272e5ba171e5a7
-
SHA512
a8e4651728bbd94d28c35d2ff757b86d6e986d271a518f4dfdb60b97884f15431abcf2c3c78dd6d2193a9eeaf99564c92099736c85b9a183b153db2c43a1c31f
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
8f4e4706e9b4e3a904862901d32e2123
C2
http://45.8.145.243/
http://78.159.97.21/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\065a30af4b949ed07c5c1761c7426f79.exe"C:\Users\Admin\AppData\Local\Temp\065a30af4b949ed07c5c1761c7426f79.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-54-0x0000000000FF0000-0x0000000001AC0000-memory.dmpFilesize
10.8MB
-
memory/1164-56-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1164-57-0x0000000000FF0000-0x0000000001AC0000-memory.dmpFilesize
10.8MB
-
memory/1164-58-0x0000000000FF0000-0x0000000001AC0000-memory.dmpFilesize
10.8MB