raccoon | 88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64 | Triage

Analysis

max time kernel
71s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
31-01-2023 13:48

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

726.7MB
MD5

c5c73e442e6e2581a7b82620ca35000b
SHA1

904f581635c55c5be9735a27b024dac8d1e7dfa4
SHA256

88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64
SHA512

15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73
SSDEEP

196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI

Score

10^/10

raccoon 4e27b39e9aaa6403f36702b4d66f5024 stealer

Malware Config

Extracted

Family

raccoon

Botnet

4e27b39e9aaa6403f36702b4d66f5024

C2

http://94.142.138.10/

http://94.142.138.9/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Setup.exe

pid process

868 Setup.exe
868 Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

868 Setup.exe
868 Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-132-0x0000000000400000-0x0000000000EAD000-memory.dmp

Filesize
10.7MB

Download
memory/868-134-0x0000000000400000-0x0000000000EAD000-memory.dmp

Filesize
10.7MB

Download
memory/868-135-0x0000000000400000-0x0000000000EAD000-memory.dmp

Filesize
10.7MB

Download