raccoon | ce44804bc5d37f89d1b6176111975da09e66e64ee9a1eecddcad0571ca32b804 | Triage

Analysis

max time kernel
120s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 19:37

Sharing

Report Analysis Logs

General

Target

satup_debloated.exe
Size

12.7MB
MD5

9f788508d906d247e833826c606034a6
SHA1

ddd868ccda90fb0ea52366424128af8d2d3b380a
SHA256

ce44804bc5d37f89d1b6176111975da09e66e64ee9a1eecddcad0571ca32b804
SHA512

b84b34950238e3c9f49c8d7c7f45cb74787c9670f47b70c48493bef77216f91b652f8316bc54737d11e9984abb9808b503d4d35cd62f31bd7c581004422c3bd6
SSDEEP

393216:oCCzYd7ZA05yeYAMIBi5exIEw7Zs4Jurfn:orzOD5YOUVs4Jc

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.143/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

satup_debloated.exe

pid process

2772 satup_debloated.exe
2772 satup_debloated.exe

C:\Users\Admin\AppData\Local\Temp\satup_debloated.exe
"C:\Users\Admin\AppData\Local\Temp\satup_debloated.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-133-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/2772-134-0x0000000000400000-0x0000000001A90000-memory.dmp

Filesize
22.6MB

Download