raccoon | 67458b55526816f5ff9e9837008cd7ab4feca77fa83a5509c4cb93b2903b92a6 | Triage

Analysis

max time kernel
141s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 07:26

Sharing

Report Analysis Logs

General

Target

AIDA64.exe
Size

293.1MB
MD5

e6899d4a73695e69e23101f7ae5a4979
SHA1

4a0768e66eab97859479823f1968092822cd2710
SHA256

67458b55526816f5ff9e9837008cd7ab4feca77fa83a5509c4cb93b2903b92a6
SHA512

4d0a566e60a7979e8999a904e5761e58f5736f86619b8644e914fc6229302dc5b7a48c7c55370603af79d503a9d9e7a25d3eb15c9ada16b559e4484e54a72ae4
SSDEEP

196608:aKJZn0pjP4Hxrx8ABvYU446EezqRJSzZVgx:PqURrx8O42ezqRJSdV

Score

10^/10

raccoon e03a7d21cf6c27d1c1b42b2ef6c4d83f stealer

Malware Config

Extracted

Family

raccoon

Botnet

e03a7d21cf6c27d1c1b42b2ef6c4d83f

C2

http://135.181.68.23/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

AIDA64.exe

pid process

616 AIDA64.exe
616 AIDA64.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AIDA64.exe

pid process

616 AIDA64.exe
616 AIDA64.exe

C:\Users\Admin\AppData\Local\Temp\AIDA64.exe
"C:\Users\Admin\AppData\Local\Temp\AIDA64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-132-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download
memory/616-134-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download
memory/616-135-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download