raccoon | 4c77d3aabcd34b20cfbd8c1383732b3d3216cafaf609a06f69dda6ff747c263b | Triage

Analysis

max time kernel
58s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 08:11

Sharing

Report Analysis Logs

General

Target

aida64.exe
Size

726.7MB
MD5

6235757f9facda9b16f498aa0f24e2a0
SHA1

15fc99e3ee6d887a59ec48fa9c5dd85e6fd7ae05
SHA256

58ae566c0ae9185f68b9c933e436e8ed1c7eba42f6211fc9a396ec3d368a6ed6
SHA512

91c64e99a20307751408d40b3522050470cbea52e9b40d665be5c381c080453f384828332a6ff9252f8fa3108c96be8ae3ed311a6f1ec2bef8413490a8d34c75
SSDEEP

196608:ZKJZn0pjP4Hxrx8ABvYU446EezqRJSzZVgxU:wqURrx8O42ezqRJSdV7

Score

10^/10

raccoon e03a7d21cf6c27d1c1b42b2ef6c4d83f stealer

Malware Config

Extracted

Family

raccoon

Botnet

e03a7d21cf6c27d1c1b42b2ef6c4d83f

C2

http://135.181.68.23/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

aida64.exe

pid process

1588 aida64.exe
1588 aida64.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aida64.exe

pid process

1588 aida64.exe
1588 aida64.exe

C:\Users\Admin\AppData\Local\Temp\aida64.exe
"C:\Users\Admin\AppData\Local\Temp\aida64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-132-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download
memory/1588-134-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download
memory/1588-135-0x0000000000400000-0x0000000000EA7000-memory.dmp

Filesize
10.7MB

Download