Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
20-11-2023 09:52
General
-
Target
ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe.exe
-
Size
17.6MB
-
MD5
1fbf52eb4aa5fb5609bb63535e283835
-
SHA1
a96aa7fb149885cbdbf1dd3fc529c003c82f6cbb
-
SHA256
ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe
-
SHA512
41e70df4b62465849bd10cd48d8e8966721575e3ede2c7c07b1e511fbd864687e1095a0351f80361cf2f69946b7fcc519e4bddd4e5a24126f05a0d747bbadb56
-
SSDEEP
393216:bu8SVoCsr12eyexwQ+/bDiZJKIIbsSSUmAWFPx/UQ0:bu8SVoCJeyexwVzcIoVA4Px/T0
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
8c43462d3009db225c4c0889737572cd
C2
http://94.142.138.49:80/
http://94.142.138.108:80/
Attributes
-
user_agent
DuckTales
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe.exe"C:\Users\Admin\AppData\Local\Temp\ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
26.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.3MB