raccoon | 506da932f06c1b88ddda7133a5a0711254f24dd6d7dd2ecf4ecdd3c4e780a307 | Triage

Analysis

max time kernel
77s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2023 20:01

Sharing

Report Analysis Logs

General

Target

iSetup.exe
Size

963.4MB
MD5

d9837847dc9af1c9016ef4a0e7b6c6bc
SHA1

e5f375af44e44274f93b63cc3ce34f6f8c8034dd
SHA256

7952fc791342a8d11f206c83aa85421fd44fba1e6e5b49dc8a6cec41ac99a475
SHA512

3b0bc12db0c1920107444623a9782786232cbcc3f9e821f814f2b99e097d7763703d8a11b5f255f91cc3a88049cb3f563ba122367035289299dd90868e74c509
SSDEEP

393216:QO+o7rCtFOVIu4rLJF7sLL+/A45K2ykhP:mofLCuAkLL+/A6K4B

Score

10^/10

raccoon 59b84a5420a33b4e78d2e5edb4d9154b stealer

Malware Config

Extracted

Family

raccoon

Botnet

59b84a5420a33b4e78d2e5edb4d9154b

C2

http://37.220.87.69

http://83.217.11.14

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

iSetup.exe

pid process

1124 iSetup.exe
1124 iSetup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

iSetup.exe

pid process

1124 iSetup.exe
1124 iSetup.exe

C:\Users\Admin\AppData\Local\Temp\iSetup.exe
"C:\Users\Admin\AppData\Local\Temp\iSetup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-133-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/1124-134-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/1124-135-0x0000000000400000-0x0000000001DF1000-memory.dmp

Filesize
25.9MB

Download