raccoon | d183a256700192ba485c441674789d0241a59688015119bf65d5cb2078e2cc13 | Triage

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 14:06

Sharing

Report Analysis Logs

General

Target

satup.exe
Size

1023.0MB
MD5

5ada73dc40f143101b30a8329ee5f230
SHA1

05c5bd86f6edf3345f34c19fe0360f318048e0fe
SHA256

5262bba7c7521cb9e694d95fc4898c4cc983ada3e21d94276c2f9a39b47670fd
SHA512

719405b982aaaa74871e3259f38b5040f11a6c51667de7e90b37a3bc31aeff2fddcb57c1d5e04a6e2864f385bea0fcddea0674e2cfd14016ef51de4e0024171c
SSDEEP

393216:lqoA2BAPVC6e/mtSMwrqGV0QuND7bbkcLMd:lZA2BEWVrPeblQ

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.143/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

satup.exe

pid process

1576 satup.exe

C:\Users\Admin\AppData\Local\Temp\satup.exe
"C:\Users\Admin\AppData\Local\Temp\satup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1576-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1576-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1576-57-0x0000000000400000-0x0000000001A77000-memory.dmp

Filesize
22.5MB

Download