Analysis
-
max time kernel
95s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21-02-2023 11:28
General
-
Target
Setup.exe
-
Size
726.5MB
-
MD5
7fb6c49cde9ba5be882706ca16319623
-
SHA1
03535e4293fd4f52188ba261194b98e0bef91f91
-
SHA256
61369af747dcb743d5100549e6ae0fd34edf329b65d488fb74c7159175f87145
-
SHA512
023bfb2d408072317f3d8ea0fb1a844e90edcd28a6506f8010feaacfc89f2b004f9dad7cfea4b5f81aa07fbe18cb062c6cb6f01593da039c2bb6a52b0d231396
-
SSDEEP
196608:ZqgN7IrT5UZrWm+JLv/iyKWouNQUDN8iM:ZvNUrTCZrJ+pv/vzoujK
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
697fc5d9af6aa2a29510779d2fc54b97
C2
http://83.217.11.27/
http://83.217.11.28/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4004-133-0x0000000000E40000-0x0000000000E41000-memory.dmpFilesize
4KB
-
memory/4004-134-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/4004-135-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/4004-136-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/4004-137-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/4004-138-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/4004-139-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/4004-140-0x0000000000400000-0x0000000000E3C000-memory.dmpFilesize
10.2MB