Analysis
- max time kernel
91s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/02/2024, 19:35
General
- Target f696295e4ffb2af642a111c28886d56a73836623c32bf4d16e4160122a7a0a98.exe
- Size 14.6MB
- Sample240201-ya2ljafdel
- SHA256 f696295e4ffb2af642a111c28886d56a73836623c32bf4d16e4160122a7a0a98
Malware Config
Extracted
-
raccoon
-
23883deb102ef0839fbfe8fcef1a5fc7
-
http://83.217.11.6
-
http://37.220.87.69
-
http://83.217.11.14
-
user_agent
B1D3N_RIM_MY_ASS
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f696295e4ffb2af642a111c28886d56a73836623c32bf4d16e4160122a7a0a98.exe"C:\Users\Admin\AppData\Local\Temp\f696295e4ffb2af642a111c28886d56a73836623c32bf4d16e4160122a7a0a98.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2836-0-0x0000000001F20000-0x0000000001F21000-memory.dmp
memory/2836-1-0x0000000001F30000-0x0000000001F31000-memory.dmp
memory/2836-2-0x0000000000400000-0x0000000001ECA000-memory.dmp
memory/2836-3-0x0000000003C00000-0x0000000003C01000-memory.dmp
memory/2836-4-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/2836-5-0x0000000003C40000-0x0000000003C41000-memory.dmp
memory/2836-7-0x0000000003C50000-0x0000000003C51000-memory.dmp
memory/2836-8-0x0000000003C60000-0x0000000003C61000-memory.dmp
memory/2836-9-0x0000000003C70000-0x0000000003C71000-memory.dmp
memory/2836-6-0x0000000000400000-0x0000000001ECA000-memory.dmp
memory/2836-12-0x0000000000400000-0x0000000001ECA000-memory.dmp