Analysis
-
max time kernel
185s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
30-11-2022 15:36
General
-
Target
a94be500bff41489e820128e5ae7cf0182cfb4008b96bae7aa84a7fc6bebd86f.exe
-
Size
5.6MB
-
MD5
2b9e4c8b5459b6b32afe8232578e62c9
-
SHA1
729cd17ddcdb3a25959402d232c4b57afc0a6205
-
SHA256
a94be500bff41489e820128e5ae7cf0182cfb4008b96bae7aa84a7fc6bebd86f
-
SHA512
bc5c73c5c88a57498c0ebf5f6ee752214c38679654ea6d0b0ce57801073942611c3032f7053b0b016988920c9794b92c33e021c94020fa01d480c41b2f81e342
-
SSDEEP
98304:XQajqcRtCO5ngBBjXUlFNV0ccSL5CAfxsL8v8FGw/4hpfIpoZoaWBV8x4t44pUFn:pjxCYYq7959Z6HGrpQuqas8x4HpUnwh
Malware Config
Extracted
raccoon
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 4 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a94be500bff41489e820128e5ae7cf0182cfb4008b96bae7aa84a7fc6bebd86f.exe"C:\Users\Admin\AppData\Local\Temp\a94be500bff41489e820128e5ae7cf0182cfb4008b96bae7aa84a7fc6bebd86f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB