raccoon | 9b23770bfff1b78fb583782c77aebcf0161c08ee8610fe02d09e5a2a88b7097f | Triage

Analysis

max time kernel
82s
max time network
80s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 21:09

Sharing

Report Analysis Logs

General

Target

Installer.exe
Size

726.3MB
MD5

a96c90d8ef480af0e7dd6555c061a6a5
SHA1

c26e574f64de531b0621a5230cbe583818422161
SHA256

081f4ba15d7910fd89f886e8c1e9cc232dd18d5d2d7d0229a2c8303865e168a1
SHA512

bda3d867f908abae40318d4f6b8695887677a94d35362efb48807dfef71fc6509baff9124eb8285a8de608cb6c664696d0c1375af2d1647a06b3f7d8651c67c8
SSDEEP

196608:9uU+fEgzWDFremiU6LqZpEte+truhmXWST:T+sHD1fiU6e+Ntruy

Score

10^/10

raccoon cebf157bc6255f468a6b8317cead3cf7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

cebf157bc6255f468a6b8317cead3cf7

C2

http://89.185.85.53/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Installer.exe

pid process

2000 Installer.exe
2000 Installer.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Installer.exe

pid process

2000 Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/2000-55-0x0000000000400000-0x0000000000DD5000-memory.dmp

Filesize
9.8MB

Download
memory/2000-57-0x0000000000400000-0x0000000000DD5000-memory.dmp

Filesize
9.8MB

Download
memory/2000-58-0x0000000000400000-0x0000000000DD5000-memory.dmp

Filesize
9.8MB

Download