Analysis
-
max time kernel
96s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-11-2024 17:26
General
-
Target
1aa954280ff704582990fa686a91f1d142b21000a36a5.exe
-
Size
17.9MB
-
MD5
48b7e5a3b1f5ffb2aaecc7ff5d8e3d97
-
SHA1
689aeb40df545d3ef9f0dbe85cca836a6d0ce8f5
-
SHA256
1aa954280ff704582990fa686a91f1d142b21000a36a55794cb5dfba05274eb5
-
SHA512
c984e1888c847aada0f5e5eeabcee8ebbce66ba86dde46e00bff47e90ba2cf44585758c021f3d19098b161abb9d22a0249250ac67ea5f73bbed455344ab8196c
-
SSDEEP
393216:aV+4mXtJ0Nm8ealfbIX8vEBQvefBj0Mos7hvvTXv3s6x6TmJfSg:s2SmwDIMSVBwMf9Hjv3sBTm0g
Malware Config
Extracted
raccoon
5937a1bd499cd3cb596ec1995a9baf6a
http://94.228.169.161:80/
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 4 IoCs
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aa954280ff704582990fa686a91f1d142b21000a36a5.exe"C:\Users\Admin\AppData\Local\Temp\1aa954280ff704582990fa686a91f1d142b21000a36a5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28.0MB
-
Filesize
28.0MB
-
Filesize
10.1MB
-
Filesize
28.0MB
-
Filesize
10.1MB
-
Filesize
28.0MB