Overview

overview

10

Static

static

3

cd63026ab5...d5.exe

windows7-x64

10

cd63026ab5...d5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    cd63026ab52a2fad9176eb875ac2d1a3ab96cbaad2d01dca0337e29b330addd5.exe

  • Size

    308KB

  • MD5

    cb4cf9a9eadd2ee673a43f7b694f7583

  • SHA1

    9fc91bf9265ba091ab84377b857df9900ef6f0f6

  • SHA256

    cd63026ab52a2fad9176eb875ac2d1a3ab96cbaad2d01dca0337e29b330addd5

  • SHA512

    29f96f57144d43025e9ac0f6d421432cbe0445c9d096e45cc8f029a881c1dd1b01896afad9b910364be6dd35a5bc0c75013b990b03672e53965622de39177d24

  • SSDEEP

    6144:anrbrVsm+9A3BUY/tJ0ZWqeBjbvI5dSK:arVF0A3mY/YwqexLcf

Score
10/10
raccoon982e12f7a62d0e0adaaadaab4c7c3e7fstealer

Malware Config

Extracted

Family

raccoon

Botnet

982e12f7a62d0e0adaaadaab4c7c3e7f

C2

http://157.90.161.111:8086/

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer payload 4 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd63026ab52a2fad9176eb875ac2d1a3ab96cbaad2d01dca0337e29b330addd5.exe
    "C:\Users\Admin\AppData\Local\Temp\cd63026ab52a2fad9176eb875ac2d1a3ab96cbaad2d01dca0337e29b330addd5.exe"
    1⤵
      PID:4684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 9744
        2⤵
        • Program crash
        PID:2496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4684 -ip 4684
      1⤵
        PID:3996

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4684-1-0x00000000025D0000-0x00000000026D0000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4684-2-0x00000000042E0000-0x00000000042FA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/4684-3-0x0000000000400000-0x00000000025A0000-memory.dmp

              Filesize

              33.6MB

              Download

            • memory/4684-4-0x00000000025D0000-0x00000000026D0000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4684-5-0x0000000000400000-0x00000000025A0000-memory.dmp

              Filesize

              33.6MB

              Download

            • memory/4684-6-0x00000000042E0000-0x00000000042FA000-memory.dmp

              Filesize

              104KB

              Download