Analysis
- max time kernel
89s - max time network
202s - platform
windows11-21h2_x64 - resource
win11-20250217-en - resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system - submitted
09/03/2025, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wtf.scr
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
wtf.scr
Resource
win11-20250217-en
windows11-21h2-x64
6 signatures
300 seconds
General
- Target wtf.scr
- Size 676.4MB
- Sample250309-dsymdaxvbz
- SHA256 e18d055fc0faaa16b5b860e1995f2cd701a89c1d7b3e2ed7c9efe5f96977e266
- MD5 6f8b3f0fb8a6ef77e799b09bc97e9803
- SHA1 2d8dde0b641755ff5641d5ed3a102182813b15f7
- SHA512 e9ff548e483a41f6f2a49ea574a21075f3266b8e3c950e263ce2b64ce988cd9a603e41898f6b46987e338e693da7e890b13c2663eff097df8207f7bb3afdc210
- SSDEEP 49152:OobxvbkfN8ObOQzhSSsOfADj58RFxDEF4B6iiw/G:hdvgN8yaDqRFxDbSr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6be8e80ea1fc8b931c125b897943cb68
C2
-
http://168.100.9.166
-
http://194.4.49.73
Attributes
-
user_agent
23591
xor.plain
Signatures
- Raccoon Stealer V2 payload 1 IoCs
resource yara_rule behavioral2/memory/2220-0-0x0000000000400000-0x000000000041E000-memory.dmp family_raccoon_v2 - Raccoon family
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtf.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pipanel.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr 248 wtf.scr - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79 PID 248 wrote to memory of 2220 248 wtf.scr 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\wtf.scr"C:\Users\Admin\AppData\Local\Temp\wtf.scr" /S1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\wtf.scr" /S2⤵
- System Location Discovery: System Language Discovery
PID:2220
-