Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21/11/2022, 10:58
General
-
Target
c4c5f46ae144945f7f557f2dafda9321ddff6501dfd2b938512c496b73e3940b.exe
-
Size
7.2MB
-
MD5
a3a28f604516c08d47b1fff38899b58b
-
SHA1
40ecd4d51a4fe5162b59408ad5c51a88c4a83495
-
SHA256
c4c5f46ae144945f7f557f2dafda9321ddff6501dfd2b938512c496b73e3940b
-
SHA512
c4491a201580371a859cfeebdec1fe43fa6fe9c95cdf127e686c974d8866717f3a0828a7734c76df0120a4635e1606538c88dd16ccbcb26ff4208f575754c652
-
SSDEEP
196608:DDboi8HWXAoZkdJh1nf51OHeR8f3RuOxrAKBZ7VrZ:DfoiKWwoCjH1OHQq3Ruq0WZB
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
ed21f92a8447e78ab0592dc4722f2ddd
C2
http://46.249.58.152/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4c5f46ae144945f7f557f2dafda9321ddff6501dfd2b938512c496b73e3940b.exe"C:\Users\Admin\AppData\Local\Temp\c4c5f46ae144945f7f557f2dafda9321ddff6501dfd2b938512c496b73e3940b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB