Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21/03/2025, 14:14
General
-
Target
138b17d8ac8f7a899f6efc896446e1794f20fb0396b774de37679b069c568f44.exe
-
Size
7.4MB
-
MD5
2333c566988bfa8a65f7e6cd079d7e8d
-
SHA1
f7300a6bc5b4f33263f7c50cae9683833f37b9bb
-
SHA256
138b17d8ac8f7a899f6efc896446e1794f20fb0396b774de37679b069c568f44
-
SHA512
abcdc8c3855290b8672f30296f709f391552e3dde0bb87feec783322a6f4906b43bb0ee90cac88b16319093515999b3c1416e223990d52d4ef759d6616ee9b05
-
SSDEEP
196608:tuJ+Rp7VEpq14hMyX1JW6+xzjbQr3HiKxMZ:tuJ+L7GpfnzWHxH8ryH
Malware Config
Extracted
raccoon
325905ef368c0ef54a7193fe509f183d
http://62.113.255.110/
http://188.215.229.203/
-
user_agent
record
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\138b17d8ac8f7a899f6efc896446e1794f20fb0396b774de37679b069c568f44.exe"C:\Users\Admin\AppData\Local\Temp\138b17d8ac8f7a899f6efc896446e1794f20fb0396b774de37679b069c568f44.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
7.4MB