Behavioral task
behavioral1
Sample
ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd_JC.exe
-
Size
88KB
-
MD5
17b1136d12dfe2c774f4e4c0e86d1fff
-
SHA1
a49bbceeb193ecf64c8e00fe251b856b5cac357c
-
SHA256
ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd
-
SHA512
b97c341e1a553e3b4f5b8e81002d053d4d8661d32f36d7281f115a9b26f6d83c5be6642dc3f96e4a49b98215bb97c853086e23fa9ec68e81b3a453f8358cf73c
-
SSDEEP
1536:JMDtfn4xngxeMcBWaiUTyBS4/HXdS34WgPhZIK4wfAet27B8uZQ2XxublNuk+l:GBfnbROWai0yBS4/Z55x4iAV7mArXxuo
Malware Config
Extracted
raccoon
ae10bcb793f8a68322201f142e7c4a14
http://91.103.252.52:80
http://91.103.252.50:80
Signatures
-
Raccoon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd_JC.exe
Files
-
ce96e10fef8c98b8500c90f5fd844030355c22d66aa37a43cbebd48659bccfcd_JC.exe.exe windows x86
9a4ec0dad65bdd0dc1e6a802e6362fd0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
FindClose
CreateMutexA
LocalAlloc
ReleaseMutex
CancelWaitableTimer
GetLastError
SetEvent
LoadLibraryA
ReleaseSemaphore
ResetEvent
CreateWaitableTimerA
GetProcAddress
LocalFree
SetEnvironmentVariableA
CreateFileMappingW
CreateSemaphoreA
CreateEventA
lstrlenA
CloseHandle
FindFirstFileA
advapi32
RegOpenKeyExA
ole32
CoInitialize
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ykbn Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE