Analysis
-
max time kernel
282s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
13/03/2023, 21:34
General
-
Target
Installer/Installer.exe
-
Size
726.5MB
-
MD5
9fc43999f4b5d41fe02c00e1b7a343e8
-
SHA1
83ed8a65c87f99cc581ef9dc20c6ca1d2a8b9f10
-
SHA256
1f8dc04a23f327f96f95f8494ff717627c6e560cf2c2dc62179c23987d5fc6cb
-
SHA512
27442b86fcfbeb0f65f7bff708bbc8f45f75c3f3a5942c089b6430949af2c30ed967415b2f564431770314a50a817cd66d622ca8593d67d2324f084becbbafa5
-
SSDEEP
98304:ph2ELTmyE34+LjULgbI4IyfGTWMMoLJsLhdZspDiQcwC+QIQwNbznrsjqpn:L2EDEctNyfGCMYjtQcAr1+Qn
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
116dcb2ce848b2e17dc22a42cdcb1665
C2
http://89.185.85.151/
http://89.185.85.149/
http://89.185.85.161/
rc4.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer\Installer.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB