Analysis
-
max time kernel
74s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
16/09/2022, 19:16
General
-
Target
2683EFFD646ED98B0E307114C8850A93EE12E497285BB.exe
-
Size
292KB
-
MD5
3be6635389f7e10a61bc55bb43ae7407
-
SHA1
904f092cd8436e3d933dea93a5008ad60cc11e71
-
SHA256
2683effd646ed98b0e307114c8850a93ee12e497285bb6acf1307d4b7edddf9c
-
SHA512
7ee569e4b289f7ad5de5b21e95cdeca4202cf6e9bb1a99b35cc06568556c639d24165eeba87f5467f43c98bb73e30ad6560f03cd2a8275c45ca937902a640a60
-
SSDEEP
6144:M7LJOX4KRlDd/49YNZmdqKtqC8p1Wf5gA:4arbDN49Y4qIiCfa
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
e1792c77619a6f2746d0d5ebe84bfa82
C2
http://168.100.9.214/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 4 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2683EFFD646ED98B0E307114C8850A93EE12E497285BB.exe"C:\Users\Admin\AppData\Local\Temp\2683EFFD646ED98B0E307114C8850A93EE12E497285BB.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 10442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4600 -ip 46001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
336KB