Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01-04-2024 09:15
General
-
Target
2024-04-01_7added706284b583067cce950419e560_icedid.exe
-
Size
3.1MB
-
MD5
7added706284b583067cce950419e560
-
SHA1
23b854a47420bbe6ad19616eb594edd0cd65a734
-
SHA256
c9c31aa87520742c070852f2197d41847df2906c3b63b94547af837140ba88ed
-
SHA512
336a7a1d6d8b0012bc7bf7ae38dca6656319bb1332cf9bd561705841945aa22ac69be6889ea8af4755b1bb94568005ecc88465826470b609690b5ced1f7a0ac5
-
SSDEEP
98304:UbPR0leq5gXtFxlH56Y+PdBN0rAf3sKDWMLmV0DC+:ER0lelD4BtmV0Dp
Score
10/10
Malware Config
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 2482⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
3.5MB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
28KB
-
Filesize
96KB
-
Filesize
28KB
-
Filesize
88KB
-
Filesize
96KB