Analysis
-
max time kernel
89s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
-
submitted
09/03/2025, 03:16
General
-
Target
wtf.scr
-
Size
676.4MB
-
MD5
6f8b3f0fb8a6ef77e799b09bc97e9803
-
SHA1
2d8dde0b641755ff5641d5ed3a102182813b15f7
-
SHA256
e18d055fc0faaa16b5b860e1995f2cd701a89c1d7b3e2ed7c9efe5f96977e266
-
SHA512
e9ff548e483a41f6f2a49ea574a21075f3266b8e3c950e263ce2b64ce988cd9a603e41898f6b46987e338e693da7e890b13c2663eff097df8207f7bb3afdc210
-
SSDEEP
49152:OobxvbkfN8ObOQzhSSsOfADj58RFxDEF4B6iiw/G:hdvgN8yaDqRFxDbSr
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
6be8e80ea1fc8b931c125b897943cb68
C2
http://168.100.9.166
http://194.4.49.73
Attributes
-
user_agent
23591
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 1 IoCs
-
Raccoon family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wtf.scr"C:\Users\Admin\AppData\Local\Temp\wtf.scr" /S1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\wtf.scr" /S2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.0MB
-
Filesize
120KB