Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 23:05
General
-
Target
0a4e062e894e1d0afeea300761abcdda30ce70e55f7e0639acbcf8f511f7e8f3.exe
-
Size
307KB
-
MD5
c816a63e12d6995da269296faed41396
-
SHA1
91ba85bd26d0c1986f3e3c78f9cf992d4f170015
-
SHA256
0a4e062e894e1d0afeea300761abcdda30ce70e55f7e0639acbcf8f511f7e8f3
-
SHA512
c64d2a8c5ec73b9c89f5af6d54ae3ca91e92faac47bba05178c20271d95753ab86766103b6d5fa4d8df917626155717aee74cd3fab93af56ca8aaefa8baeb25b
-
SSDEEP
6144:4mavSTXk7DsoUaHDkyZyskVY7Wcf9JpphyGn:DPTU/sTkVyY6+JVyW
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
31a59997888d26d92577b25b8030e2c1
C2
http://157.90.161.111:8086/
Attributes
-
user_agent
SunShineMoonLight
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 4 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a4e062e894e1d0afeea300761abcdda30ce70e55f7e0639acbcf8f511f7e8f3.exe"C:\Users\Admin\AppData\Local\Temp\0a4e062e894e1d0afeea300761abcdda30ce70e55f7e0639acbcf8f511f7e8f3.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 97442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3656 -ip 36561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
104KB
-
Filesize
33.6MB
-
Filesize
1024KB
-
Filesize
33.6MB
-
Filesize
104KB