raccoon | 901c4fc8c8a5cd7de5536f98e97df4eb84bb328c32dab62dbb01a566d6d776c6 | Triage

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 17:33

Sharing

Report Analysis Logs

General

Target

satup.exe
Size

1023.0MB
MD5

b0adfbbb3691d0dcbcf5e61fdb4ed7cf
SHA1

6eba067895f805ad558469ebfb2256b11a322caf
SHA256

4041481fd62b529ee53ac26ba978362679d2230c48ba53abd7661a3c552b3e66
SHA512

6e82fd34c4c94ad15c963884fbfae48d7a4a2d1072ce4315071ef2bcb25663a984a28eb0241030417214bc8980326e4244d9b53e2ea89b6e48e56f99f0bc4ee9
SSDEEP

393216:oCCzYd7ZA05yeYAMIBi5exIEw7Zs4Jurfng:orzOD5YOUVs4Jcg

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.143/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

satup.exe

pid process

1100 satup.exe

C:\Users\Admin\AppData\Local\Temp\satup.exe
"C:\Users\Admin\AppData\Local\Temp\satup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1100-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1100-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1100-57-0x0000000000400000-0x0000000001A90000-memory.dmp

Filesize
22.6MB

Download