raccoon | 8f99effc679549c2af919814cbf114542a20d267e622804c97c06da3f6108ef9 | Triage

Analysis

max time kernel
149s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 04:07

Sharing

Report Analysis Logs

General

Target

SoftWare 2023/Setup.exe
Size

733.1MB
MD5

d5bb80569e355d6e65de761d46b39da0
SHA1

8731c0883164cc951e3e80be5c64ef09400324a7
SHA256

213ec8ae881fbf7821c8e6574f37452bc6bb92f93ac634aa43adb5300138e614
SHA512

1b3593c746b79a056c15b7fe8c91c2f38685bb32eb924e34d94ba64c42cf41014ba52f2ef2bc8140837fb05f2fa04ffce92ca694c72faf9461cab88fbf805d9d
SSDEEP

393216:fCnzmUSYCLfqwNh5kbGUf/t1ow5QnBE6Ye:fJUSrLS8hObGUdf50a7e

Score

10^/10

raccoon 717609e6131226f92ce8ce08c34305be stealer

Malware Config

Extracted

Family

raccoon

Botnet

717609e6131226f92ce8ce08c34305be

C2

http://45.9.74.170

http://77.73.134.43

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Setup.exe

pid process

4736 Setup.exe
4736 Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

4736 Setup.exe
4736 Setup.exe

C:\Users\Admin\AppData\Local\Temp\SoftWare 2023\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare 2023\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-133-0x0000000001C50000-0x0000000001C51000-memory.dmp

Filesize
4KB

Download
memory/4736-134-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/4736-135-0x0000000000400000-0x0000000001B75000-memory.dmp

Filesize
23.5MB

Download