raccoon | 961211ad16c99dacf138c2892d9a3c4427891bee86cf43fd65b01fb52f88959b | Triage

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 14:29

Sharing

Report Analysis Logs

General

Target

satup.exe
Size

1024.0MB
MD5

11f3f6e269c4bf209429c4ef873d948b
SHA1

a33fa3adda9429d56cbe5ed7ff4038a9e4929218
SHA256

e26e26deabfcc2cf2efa7fd3e1ee304049a1310968ca376884b64bbb7c7c0b62
SHA512

378adf0cbd0453e63af8137696c2a7c7414acd1d6f87d6b548948d887317b88dcc1e0e69502255f3b7e327888602a5def4ed5844635f1034dd3f971f7f5970d0
SSDEEP

393216:oCCzYd7ZA05yeYAMIBi5exIEw7Zs4Jurfng:orzOD5YOUVs4Jcg

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.143/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

satup.exe

pid process

4120 satup.exe
4120 satup.exe

C:\Users\Admin\AppData\Local\Temp\satup.exe
"C:\Users\Admin\AppData\Local\Temp\satup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-133-0x0000000001B10000-0x0000000001B11000-memory.dmp

Filesize
4KB

Download
memory/4120-134-0x0000000000400000-0x0000000001A90000-memory.dmp

Filesize
22.6MB

Download