raccoon | e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 20:58

Target

a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe
Size

775KB
MD5

a680ae77d7dcbc614386f1b4ae2d6574
SHA1

a263a39a2b7fd3c5fb0bb75caa789f2055f3462b
SHA256

e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742
SHA512

21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16
SSDEEP

12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+

Score

10^/10

Family

raccoon

Botnet

4b9b8980a10a7e59f200af975a29a100ba819fe0

Attributes

url4cnc
http://telemirror.top/ararius809b

http://tgmirror.top/ararius809b

http://telegatt.top/ararius809b

http://telegka.top/ararius809b

http://telegin.top/ararius809b

https://t.me/ararius809b

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 3 IoCs

resource	yara_rule
behavioral1/memory/2000-4-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral1/memory/2000-11-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral1/memory/2000-12-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28
PID 2228 wrote to memory of 2000	2228	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2000

memory/2000-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2000-4-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2000-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2000-11-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2000-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2228-1-0x00000000003B0000-0x00000000004B0000-memory.dmp

Filesize
1024KB

Download