Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2024 07:01

General

  • Target

    adb818f384854f8caec01d9885261eca0de05f4f37c7e30fa77744b7243ae1a6.exe

  • Size

    184KB

  • MD5

    742f580700aefcb1b1cc5750dd1a8ef2

  • SHA1

    0fe20886fd83b9f1696febf89df7bc9df9cd9eff

  • SHA256

    adb818f384854f8caec01d9885261eca0de05f4f37c7e30fa77744b7243ae1a6

  • SHA512

    9f5ead271eb705db629e2b81de9231ef97ce040f524db0764be455e8adfc1d34cf2fd3653dc08ce2c52f2869b991e2165ba00e1b196a486f3b0336dc73c0e003

  • SSDEEP

    3072:ESN01tePgeCI2MFz1XOXZte+APb59MzKR5XKjZER/Fy:E1SHjz1XOZteH/MzY/

Malware Config

Extracted

Family

raccoon

Botnet

b1b69a5521fd2b2e62f67a924215af64

C2

http://138.201.88.153:8998/

Attributes
  • user_agent

    Zadanie

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V2 payload 3 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\adb818f384854f8caec01d9885261eca0de05f4f37c7e30fa77744b7243ae1a6.exe
    "C:\Users\Admin\AppData\Local\Temp\adb818f384854f8caec01d9885261eca0de05f4f37c7e30fa77744b7243ae1a6.exe"
    1⤵
      PID:2032

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2032-0-0x0000000000400000-0x0000000002CF2000-memory.dmp

      Filesize

      40.9MB

    • memory/2032-3-0x00000000002C0000-0x00000000002DD000-memory.dmp

      Filesize

      116KB

    • memory/2032-2-0x0000000002D70000-0x0000000002E70000-memory.dmp

      Filesize

      1024KB

    • memory/2032-4-0x0000000000400000-0x0000000002CF2000-memory.dmp

      Filesize

      40.9MB

    • memory/2032-7-0x0000000002D70000-0x0000000002E70000-memory.dmp

      Filesize

      1024KB