Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
10/03/2024, 19:56
General
-
Target
2856A877DE2DB673A2BBA91BE84FCF4D.exe
-
Size
17.2MB
-
MD5
2856a877de2db673a2bba91be84fcf4d
-
SHA1
64c90211ec0e306e43928afb8343407bca115a20
-
SHA256
2a895eed42d2900a9f8d4cfc29383c5137b142c791f6873b0118c633f23ef6a5
-
SHA512
2a69277b52994b6ac0dc745788e57f97ba17a062ee5a550e64c6ff2844ddfd63cd380434acff892c443795de8c525200b533463502e8c9a01d2e3e3c132c6e05
-
SSDEEP
393216:UtVQiO5y4LqyLjSffL/U5F+Jw6es/33V5dL2oAKEa7V0q2xo:Ut1OgoOffLy+C6Z3LdL2thYV0qv
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
104002ed160c6388b0427836b3731039
C2
http://193.233.132.204:80
Attributes
-
user_agent
MrBidenNeverKnow
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2856A877DE2DB673A2BBA91BE84FCF4D.exe"C:\Users\Admin\AppData\Local\Temp\2856A877DE2DB673A2BBA91BE84FCF4D.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28.2MB
-
Filesize
28.2MB