Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 16:27
General
-
Target
wrapper_jre_offline.exe
-
Size
19.2MB
-
MD5
641d6655a3e29cc7614c8b957862e1c4
-
SHA1
62e64aa2c9350b595d464a9b86b7523c908b89f5
-
SHA256
c059b783b68ef84c1743e29fc176231e88de977eddb9b78a92c2327a811875c6
-
SHA512
3f1036bcbb51ce7881ba87d9e92a12e7c3488640233205eb2f51e6af8b31906bf939a303b339b915f59cace99171a4688c755207d0c9640511b7d6b804ab200c
-
SSDEEP
393216:Tlss9NuVHhMhFq4h5kC9h/gx4R+l5iq8SI1uIb:X9ghIfh5kCPIKiL8W
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
5937a1bd499cd3cb596ec1995a9baf6a
C2
http://94.228.169.161:80/
Attributes
-
user_agent
MrBidenNeverKnow
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wrapper_jre_offline.exe"C:\Users\Admin\AppData\Local\Temp\wrapper_jre_offline.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
30.1MB
-
Filesize
30.1MB
-
Filesize
10.8MB
-
Filesize
30.1MB
-
Filesize
10.8MB
-
Filesize
30.1MB