raccoon | 9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b | Triage

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 21:22

Sharing

Report Analysis Logs

General

Target

File_PC_Setup-2023.exe
Size

726.4MB
MD5

b60b64ca1759378a14e329c2da0584dc
SHA1

a24f921026178c736e0b010e40ab811765a6aece
SHA256

9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b
SHA512

a6b18870a7ea44d9deab77d5a260045e0bac8ee7fbbf1db7e673f3c2ada6dad59be680c787c4a6a793d3243698de93b253775812cc55382fb178af2f2a3c8d96
SSDEEP

196608:z8G40ydTNxM5sDGXOQ8TJ1cLWXm3U40Y5eCvWOIsUeF:zbydTNxM5sDN1XmX0ieCvWzbeF

Score

10^/10

raccoon 8c3e4aa007fb2f2defacc1f952806f72 stealer

Malware Config

Extracted

Family

raccoon

Botnet

8c3e4aa007fb2f2defacc1f952806f72

C2

http://51.255.211.170/

http://45.15.159.197/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2692	File_PC_Setup-2023.exe
2692	File_PC_Setup-2023.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	File_PC_Setup-2023.exe
2692	File_PC_Setup-2023.exe

C:\Users\Admin\AppData\Local\Temp\File_PC_Setup-2023.exe
"C:\Users\Admin\AppData\Local\Temp\File_PC_Setup-2023.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-132-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download
memory/2692-134-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download
memory/2692-135-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download
memory/2692-136-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download