raccoon | ebec7e22109660526ff989561557d6193a2a5f42e3c798ef9144ef5d87cf22c0 | Triage

Resubmissions

02/11/2022, 14:33

221102-rw3mdscagq 1

26/10/2022, 07:23

221026-h784wafac4 10

05/10/2022, 12:44

221005-pygrlaecg4 10

Analysis

max time kernel
100s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 07:23

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

354.5MB
MD5

478c91f27cc9d2d837893ba314c3fab4
SHA1

7b4d5edf31471392b3b2a831f2d72840844d75db
SHA256

fcf421952d84ded2ae3c64d60e404be047df6bbf7c126286d673301ea9639296
SHA512

43e2ae908624b265b02f9ab9d47e5aef205e24fce0078aa343c33e7ecccdd9e6333dd2c1523cd0091b4e345857f61e776058c79c95901436120fd808c95150a8
SSDEEP

98304:yqBddY+ska8QNmSxQP8k86PTZWi7cyZ/2niOVDHdwUqwsLUnL+oSsL98ao:yqBvYfFmSA8klr0DykldCLUnH8H

Score

10^/10

raccoon 4346e67ff7008df6f26a01502c3596ac stealer

Malware Config

Extracted

Family

raccoon

Botnet

4346e67ff7008df6f26a01502c3596ac

C2

http://94.131.98.5/

http://94.131.97.129

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	Setup.exe
1216	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-132-0x0000000000D50000-0x000000000184B000-memory.dmp

Filesize
11.0MB

Download
memory/1216-135-0x0000000000D50000-0x000000000184B000-memory.dmp

Filesize
11.0MB

Download
memory/1216-136-0x0000000000D50000-0x000000000184B000-memory.dmp

Filesize
11.0MB

Download