Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/03/2025, 02:42
General
-
Target
2025-03-06_b0b92a8cc1bbd59c50bb46efecba5d60_mafia.exe
-
Size
571KB
-
MD5
b0b92a8cc1bbd59c50bb46efecba5d60
-
SHA1
7911a9d8d1f5ea40111645608d6e4b28ce594db5
-
SHA256
aefe1a33ea0fadfe030b57ac20a77ac3b1bd3295a2dd698b8fd7f973e0277134
-
SHA512
886dfe2541a31997e2a859f31dee67e1d3d87838cc14048801336fb8885baa416b7e351d779c257b0371fbd12752caf554a8e0051b2d15ea470441a4098584ac
-
SSDEEP
12288:K9R+hzGBVId9w6SC/zqrWd6yu0FsFA8JTC2mxi2uIdMmebX5Qhx:K+hyyVSC/CWQyu0FsF/JBmxiTmUex
Malware Config
Extracted
raccoon
a848572cf0cf0bfe8c432b6db30df279d8849138
-
url4cnc
https://drive.google.com/uc?export=download&id=1eZ-c6t9mtGXtiFBycQbjztj_sXT0TNw1
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V1 payload 3 IoCs
-
Raccoon family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_b0b92a8cc1bbd59c50bb46efecba5d60_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_b0b92a8cc1bbd59c50bb46efecba5d60_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 3282⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
476KB
-
Filesize
700KB
-
Filesize
1024KB
-
Filesize
476KB