Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22-04-2024 18:49
General
-
Target
0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe
-
Size
337KB
-
MD5
eaafa70d95f1ac8d0ba678002c316870
-
SHA1
f716edc6c1897549c86a82ca763ce4b04224d5ea
-
SHA256
0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc
-
SHA512
01d70885d95132a292c6cbabb0a2dc4517cc7e1821bad6adbb5ddd9ba1cbcfbf71addbf0974792797202dd49230a22bf19b7af93c98feec78bc3bb59c5e16004
-
SSDEEP
3072:ZdF2c/3qO8qQDzNbR8tYZm597CbWSCPvKXw/Z/c8p3o:LF2s3z8qQVtYYM5tCbteiA/B
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
1b186ec3b9bf16462aab87ee1bbfe070
C2
http://193.27.14.212:80
Attributes
-
user_agent
SunShineMoonLight
xor.plain
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 3 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe"C:\Users\Admin\AppData\Local\Temp\0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1660-1-0x00000000029F0000-0x0000000002AF0000-memory.dmpFilesize
1024KB
-
memory/1660-2-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/1660-3-0x0000000000400000-0x00000000025A7000-memory.dmpFilesize
33.7MB
-
memory/1660-4-0x0000000000400000-0x00000000025A7000-memory.dmpFilesize
33.7MB
-
memory/1660-6-0x00000000029F0000-0x0000000002AF0000-memory.dmpFilesize
1024KB