Overview

overview

10

Static

static

Setup.exe

windows7-x64

1

Setup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2023 10:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    726.7MB

  • MD5

    2d60d7a1d5a318428f0174cb11fd6a2a

  • SHA1

    3e1f2ed3c74258886e64b88e4787391d01138009

  • SHA256

    e1bfff83d45e1d31c9e9cb3d2640d645aa9ab8c9ca70fff576b3926777bf846e

  • SHA512

    0efd1f26c590044ad758b8c78081acfb79c70244947ae891a984807e7f446fd5f6e4933fd0831cd76b915cf78406b0b57d8b9d03c5ff0b4a67f42531c1ce5746

  • SSDEEP

    98304:cCTD5Mri+t9nwDlFQveHwXrgG/IXZMXr6vU2EsQ6I/VFdrQTg8MStd+O7ANXbmE5:E209w5Weu7/4uOvU6nCVQTjld+OkNLtj

Score
10/10
raccoon1269ed6cdc166a49ecc72e46095cfacestealer

Malware Config

Extracted

Family

raccoon

Botnet

1269ed6cdc166a49ecc72e46095cface

C2

http://79.137.197.160/

http://79.137.197.190/
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/968-132-0x0000000000400000-0x0000000000EA0000-memory.dmp
    Filesize

    10.6MB

    Download
  • memory/968-134-0x0000000000400000-0x0000000000EA0000-memory.dmp
    Filesize

    10.6MB

    Download
  • memory/968-135-0x0000000000400000-0x0000000000EA0000-memory.dmp
    Filesize

    10.6MB

    Download