Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb04ee69ca77611d15bf1cb1c3a37b52.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
cb04ee69ca77611d15bf1cb1c3a37b52.exe
-
Size
1.5MB
-
MD5
cb04ee69ca77611d15bf1cb1c3a37b52
-
SHA1
90c0923fcd672c7cbe4079cde5d08641edde65ea
-
SHA256
3ab7eca908cbfcc0aefea517b4482efbe5c0e7c6c55b23ae3d05125fb5cc29e4
-
SHA512
a0f291450390a7dbaa4479fdd4f62fa26057a2ac5376569900accac744c775aceb346dad4c62c164f5ffb31b30fb4ae778a0b100465f5699bf1b965de51f44bd
-
SSDEEP
24576:OG++PWQamhejtodtzcodFukj/gfsEBQetmbf8GfPLg:r/2odtcodf/gsGQewbUGfP
Malware Config
Signatures
-
Raccoon Stealer V1 payload 14 IoCs
resource yara_rule behavioral2/memory/2032-1-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-2-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-3-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-4-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-5-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-6-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-7-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-8-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-9-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-10-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-11-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-12-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-13-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 behavioral2/memory/2032-14-0x0000000000220000-0x0000000000656000-memory.dmp family_raccoon_v1 -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2032 cb04ee69ca77611d15bf1cb1c3a37b52.exe