Analysis
-
max time kernel
85s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
10-09-2022 14:42
General
-
Target
Installer.exe
-
Size
726.0MB
-
MD5
75445f1c9cd44d3148532ce1f02a78c3
-
SHA1
383d5dbf5fc745cf1c3ca2bc360b55aa109ff2bb
-
SHA256
6e3af05d0e36062681fd9b4fdb601e605b44e414689a9d61b96fbf25e439166d
-
SHA512
910142788341d2e7b3158801214022efac1663f424fb87cf537179b2cb0e17303c688027f2f420c9096cf5ef77a19596244fa9de0edfbac65c48b0b481903960
-
SSDEEP
98304:gGtTHVNvmnL54wqxllJ2CDJNG3Gc5Y1orJmhnZqDErjOCWHs34vtZLvCG:lH84wsJRDs21o99wWHs+DuG
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
3efe9181f37a78f608e51162796a63f7
C2
http://146.70.125.95/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1696-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1696-55-0x0000000000400000-0x0000000000D5D000-memory.dmpFilesize
9.4MB
-
memory/1696-57-0x0000000000400000-0x0000000000D5D000-memory.dmpFilesize
9.4MB
-
memory/1696-58-0x0000000000400000-0x0000000000D5D000-memory.dmpFilesize
9.4MB