Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
31-07-2023 12:56
General
-
Target
Setup_x32_x64.exe
-
Size
992.0MB
-
MD5
aa87368fd85c71caebb069bbd711b5ba
-
SHA1
2c2390bb8cff65b843a682cdb613909cc5fc3579
-
SHA256
1f88c89c82edcde05886262f770bd3df3af0049924d7e290cdc3ab6586503e0a
-
SHA512
4d99c8857d50729e1e99a0f477f5950deff6c11a820095ce765946100b0a0ee58a4fe483589459fba9c5683b79a8f8946879b2cf33eb79fa0a1b486bd64210ca
-
SSDEEP
196608:gpKYW15rR/FityRl28WklfrrN+tBaa/bK0a99R:g0YsTUcP27SfctBV+089R
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
94c54520400750937a6f1bf6044f8667
C2
http://185.181.10.208/
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 4 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
9.8MB