Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
06/08/2022, 08:46
General
- Target 68d437052ba03d883891100448526f77.exe
- Size 7.1MB
- Sample220806-kpavgacgem
- SHA256 e478b4ce3f8b8d0a2a6f88e5eee26e4f19528b55fa3dfe92258b5e08da8df2e0
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
5fc047a9c5cf5165300d503b77ab137d
C2
-
http://51.195.166.176
rc4.plain
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer payload 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68d437052ba03d883891100448526f77.exe"C:\Users\Admin\AppData\Local\Temp\68d437052ba03d883891100448526f77.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3380-130-0x0000000000040000-0x0000000000B48000-memory.dmp
memory/3380-132-0x0000000000040000-0x0000000000B48000-memory.dmp
memory/3380-133-0x0000000000040000-0x0000000000B48000-memory.dmp
memory/3380-134-0x0000000000040000-0x0000000000B48000-memory.dmp