Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21-02-2023 11:28
General
-
Target
Setup.exe
-
Size
726.5MB
-
MD5
7fb6c49cde9ba5be882706ca16319623
-
SHA1
03535e4293fd4f52188ba261194b98e0bef91f91
-
SHA256
61369af747dcb743d5100549e6ae0fd34edf329b65d488fb74c7159175f87145
-
SHA512
023bfb2d408072317f3d8ea0fb1a844e90edcd28a6506f8010feaacfc89f2b004f9dad7cfea4b5f81aa07fbe18cb062c6cb6f01593da039c2bb6a52b0d231396
-
SSDEEP
196608:ZqgN7IrT5UZrWm+JLv/iyKWouNQUDN8iM:ZvNUrTCZrJ+pv/vzoujK
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
697fc5d9af6aa2a29510779d2fc54b97
C2
http://83.217.11.27/
http://83.217.11.28/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-133-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/1872-134-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/1872-135-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/1872-136-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1872-137-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1872-138-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/1872-139-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/1872-140-0x0000000000400000-0x0000000000E3C000-memory.dmpFilesize
10.2MB