Overview

overview

10

Static

static

7

racoon/36a...27.exe

windows10-2004-x64

10

racoon/5ec...48.exe

windows10-2004-x64

10

racoon/807...9a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2023 04:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    racoon/5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648.exe

  • Size

    395.1MB

  • MD5

    6e304cd6d12c0d31869ed6e45fff4633

  • SHA1

    a5bb3c851cbf05c88357074ea66e272f839d0537

  • SHA256

    5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648

  • SHA512

    8ba2a27800e5062ee96d1f3a6f1485584c6762276a2016d7f02c3f33201fd664c77f27d47ec3c8706eed6ba3661116c95aff1213d544f792f83640412b97a1f5

  • SSDEEP

    196608:8YUmSslap7QMHe5HhVrHI/dl/v9TtZJD05y:ldEdCzrHSbv9troy

Score
10/10
raccoon8eb14caca01131f5f4ff62ef8a0fcab4stealer

Malware Config

Extracted

Family

raccoon

Botnet

8eb14caca01131f5f4ff62ef8a0fcab4

C2

http://74.119.192.56/

http://146.19.170.153/
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\racoon\5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648.exe
    "C:\Users\Admin\AppData\Local\Temp\racoon\5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4736-132-0x0000000000C60000-0x00000000016F0000-memory.dmp
    Filesize

    10.6MB

    Download
  • memory/4736-135-0x0000000000C60000-0x00000000016F0000-memory.dmp
    Filesize

    10.6MB

    Download
  • memory/4736-136-0x0000000000C60000-0x00000000016F0000-memory.dmp
    Filesize

    10.6MB

    Download