Analysis

  • max time kernel
    191s
  • max time network
    305s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-03-2024 22:09

General

  • Target

    2-3-1_2023-12-14_13-35.exe

  • Size

    273KB

  • MD5

    95f70460434d32448cfb8e78e77edb14

  • SHA1

    e30bdda770c6f13a370f4858299b064b9dc58fac

  • SHA256

    28a08faeade7234ec9b0e78b780c1787137581641c57ef6e8088d314b447751a

  • SHA512

    1a79967e02dfe717a2c212b303b0d1fae66483b94488a9784f664ba97bf32d3748283098809d1cae5e6cfc319156cd3ccb9db6222492cdbe21a0c352e5e97c62

  • SSDEEP

    3072:yRxm2/NDzdE3AlymGqo8bMufXYcNEFyxWvdOD5oF1KDsBTgn:yRxd/NDzmMymFBbMuDeFyxSpPUsBT

Malware Config

Extracted

Family

raccoon

Botnet

afed87781b48070c555e77a16d871208

C2

http://185.16.39.253:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V2 payload 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2-3-1_2023-12-14_13-35.exe
    "C:\Users\Admin\AppData\Local\Temp\2-3-1_2023-12-14_13-35.exe"
    1⤵
      PID:1204

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-1-0x0000000000A30000-0x0000000000B30000-memory.dmp

      Filesize

      1024KB

    • memory/1204-2-0x00000000008D0000-0x00000000008E6000-memory.dmp

      Filesize

      88KB

    • memory/1204-3-0x0000000000400000-0x0000000000866000-memory.dmp

      Filesize

      4.4MB

    • memory/1204-4-0x0000000000400000-0x0000000000866000-memory.dmp

      Filesize

      4.4MB

    • memory/1204-5-0x0000000000A30000-0x0000000000B30000-memory.dmp

      Filesize

      1024KB