Overview

overview

10

Static

static

1

-Setup1_patched.exe

windows7-x64

10

-Setup1_patched.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2023 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    -Setup1_patched.exe

  • Size

    16.1MB

  • MD5

    18a0abe1b5f19e95cc6e1cbf27ac3517

  • SHA1

    7a954568777b54f9e09e5d60715c7737645eafa4

  • SHA256

    881711145f8f14dd621272bbc95774ceef9d707209d906da0b1a12f8319d16e8

  • SHA512

    b52cb41973e2838f8e25c64a0ce0b442b5e65899d032e0ac2f01f179c9365d7348902ad39990e54f318123b4ced92b09a1d996e71cb708f8bbeac68f81212a30

  • SSDEEP

    393216:lZPnL/xPlL3GxIvZBE/oW1BG3TQoVEc6xNSKUffaEIi1:lB5NL37ZBE/oW1ByTTVVKUKUffaEIi

Score
10/10
raccoon13718a923845c0cdab8ce45c585b8d63stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.198/

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\-Setup1_patched.exe
    "C:\Users\Admin\AppData\Local\Temp\-Setup1_patched.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/912-54-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-55-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-56-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-59-0x0000000000250000-0x0000000000251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-58-0x0000000000250000-0x0000000000251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-57-0x0000000000250000-0x0000000000251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/912-60-0x0000000000400000-0x000000000217C000-memory.dmp
    Filesize

    29.5MB

    Download