Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 17:50
General
-
Target
6nd0y.exe
-
Size
510KB
-
MD5
dca5704bd1e65939693475fd84c63eca
-
SHA1
679d419e392280269f88ea967c81848b0004dc06
-
SHA256
02d72fe8ef6500bc4316ed8304d0f50b61589bbc0bb27d3636b88543821e1dc5
-
SHA512
b168fc37159f5ae8cb1eba3a365442b3e6fddec241c4f5bf8b8bf7ab9939cc5b013cf72c2f12e336ff1caf01ae0aff7d5a60cedb55ef7a299c3ec51fa71784b8
-
SSDEEP
12288:4bFaeTaaODKlG1afBdslOQx7ADq14X/btwcNMval:2I2W+p7slJxzipwWMyl
Malware Config
Extracted
raccoon
ca6c203ef4ac49812d3e458b919004520e3e684b
-
url4cnc
http://85.159.212.113/josofast
http://185.163.204.81/josofast
http://194.180.191.33/josofast
http://174.138.11.98/josofast
http://194.180.191.44/josofast
http://91.219.236.120/josofast
https://t.me/josofast
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V1 payload 6 IoCs
-
Raccoon family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6nd0y.exe"C:\Users\Admin\AppData\Local\Temp\6nd0y.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
584KB
-
Filesize
588KB
-
Filesize
1024KB
-
Filesize
584KB
-
Filesize
680KB
-
Filesize
588KB
-
Filesize
680KB