Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 05:17

General

  • Target

    29aaac94e2edef7a8c57d4355d74598e.exe

  • Size

    575KB

  • MD5

    29aaac94e2edef7a8c57d4355d74598e

  • SHA1

    6edf124b2fc715b5160e09a2eb1d92d336f5bcfd

  • SHA256

    7b874a9ec6e79839129a880e9bdbd81b3e5241d65c24acb98863e4de354606fd

  • SHA512

    a6b8e79b8d08ee25f35bde1911df01a7ec532b0992b223a59b66764a2c8525322f0ebda831eed5b613b0fd9ff32706d832091ee2b1175ca55ce5a9cd3f9c90a0

  • SSDEEP

    12288:iC5CpXwVp3/0tWjDnDBqL7QyCedLMvlu/tZPx8MdEgJ9s:iLwVpv35yp2luL5Xd

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

31bcfc27d8b618567f214bdc9ba012927bc6bce2

Attributes
  • url4cnc

    https://telete.in/jdiamond13

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29aaac94e2edef7a8c57d4355d74598e.exe
    "C:\Users\Admin\AppData\Local\Temp\29aaac94e2edef7a8c57d4355d74598e.exe"
    1⤵
    • Modifies system certificate store
    PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2320-2-0x0000000000220000-0x00000000002B3000-memory.dmp

    Filesize

    588KB

  • memory/2320-3-0x0000000000400000-0x00000000004AB000-memory.dmp

    Filesize

    684KB

  • memory/2320-1-0x00000000005F0000-0x00000000006F0000-memory.dmp

    Filesize

    1024KB

  • memory/2320-6-0x00000000005F0000-0x00000000006F0000-memory.dmp

    Filesize

    1024KB

  • memory/2320-7-0x0000000000220000-0x00000000002B3000-memory.dmp

    Filesize

    588KB