raccoon | e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742

Analysis

max time kernel
136s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe
Size

775KB
MD5

a680ae77d7dcbc614386f1b4ae2d6574
SHA1

a263a39a2b7fd3c5fb0bb75caa789f2055f3462b
SHA256

e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742
SHA512

21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16
SSDEEP

12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+

Score

10^/10

raccoon 4b9b8980a10a7e59f200af975a29a100ba819fe0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

4b9b8980a10a7e59f200af975a29a100ba819fe0

Attributes

url4cnc
http://telemirror.top/ararius809b

http://tgmirror.top/ararius809b

http://telegatt.top/ararius809b

http://telegka.top/ararius809b

http://telegin.top/ararius809b

https://t.me/ararius809b

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

resource	yara_rule
behavioral2/memory/2284-2-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/2284-8-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4208	4916	WerFault.exe	86

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94
PID 4916 wrote to memory of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94
PID 4916 wrote to memory of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94
PID 4916 wrote to memory of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94
PID 4916 wrote to memory of 2284	4916	a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 276
  2⤵
  - Program crash
  PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4916 -ip 4916
1⤵
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-8-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4916-1-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download