Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 09:15

General

  • Target

    2024-04-01_7added706284b583067cce950419e560_icedid.exe

  • Size

    3.1MB

  • MD5

    7added706284b583067cce950419e560

  • SHA1

    23b854a47420bbe6ad19616eb594edd0cd65a734

  • SHA256

    c9c31aa87520742c070852f2197d41847df2906c3b63b94547af837140ba88ed

  • SHA512

    336a7a1d6d8b0012bc7bf7ae38dca6656319bb1332cf9bd561705841945aa22ac69be6889ea8af4755b1bb94568005ecc88465826470b609690b5ced1f7a0ac5

  • SSDEEP

    98304:UbPR0leq5gXtFxlH56Y+PdBN0rAf3sKDWMLmV0DC+:ER0lelD4BtmV0Dp

Score
10/10

Malware Config

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V2 payload 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 540
      2⤵
      • Program crash
      PID:4248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2272 -ip 2272
    1⤵
      PID:876

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2272-0-0x0000000000400000-0x000000000077C000-memory.dmp

      Filesize

      3.5MB

    • memory/2272-2-0x0000000000D60000-0x0000000000D6A000-memory.dmp

      Filesize

      40KB

    • memory/2272-4-0x0000000000D60000-0x0000000000D6A000-memory.dmp

      Filesize

      40KB

    • memory/2272-5-0x0000000000D70000-0x0000000000D77000-memory.dmp

      Filesize

      28KB

    • memory/2272-7-0x0000000000D70000-0x0000000000D77000-memory.dmp

      Filesize

      28KB

    • memory/2272-8-0x0000000000D80000-0x0000000000D84000-memory.dmp

      Filesize

      16KB

    • memory/2272-9-0x0000000000D80000-0x0000000000D84000-memory.dmp

      Filesize

      16KB

    • memory/2272-10-0x0000000000D90000-0x0000000000DA8000-memory.dmp

      Filesize

      96KB

    • memory/2272-11-0x0000000000D90000-0x0000000000DA8000-memory.dmp

      Filesize

      96KB

    • memory/2272-12-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

      Filesize

      88KB