raccoon | 367f6ba2d6f4014c4f599c1fe5596190f4573c53c8f55564044deada74bcc55c

Analysis

max time kernel
154s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe
Size

564KB
MD5

eb29c0d9cdec9593430ea87bd3e5a5f9
SHA1

75dbc7ae700f80a4d19480531ec01b56be57a835
SHA256

367f6ba2d6f4014c4f599c1fe5596190f4573c53c8f55564044deada74bcc55c
SHA512

8eb56eba6ecd419dc577adc587a6653c297bccd71cacbd34c9cd25888644e281ae7aa0293d886f71bba6fdc266af4a2512ac22113374610112b96a707dce3312
SSDEEP

12288:CtpsBZ0OjYv9t/TTbqkXbyYYnzOUOtdqUt1ubRtC:Ctps/Dw9RfqkXbyrnzWtb1ue

Score

10^/10

raccoon e2b58b2c24d80fcfd249021c5a21ac97c09e40a1 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e2b58b2c24d80fcfd249021c5a21ac97c09e40a1

Attributes

url4cnc
https://telete.in/mohibrainos

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 6 IoCs

resource	yara_rule
behavioral2/memory/2368-5-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral2/memory/2368-6-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral2/memory/2368-7-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral2/memory/2368-9-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral2/memory/2368-12-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral2/memory/2368-13-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 2368	4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe	95

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2368	4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe	95
PID 4908 wrote to memory of 2368	4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe	95
PID 4908 wrote to memory of 2368	4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe	95
PID 4908 wrote to memory of 2368	4908	eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eb29c0d9cdec9593430ea87bd3e5a5f9_JaffaCakes118.exe"
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-5-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2368-6-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2368-7-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2368-9-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2368-10-0x0000000077682000-0x0000000077683000-memory.dmp

Filesize
4KB

Download
memory/2368-11-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2368-12-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2368-13-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4908-2-0x0000000077682000-0x0000000077683000-memory.dmp

Filesize
4KB

Download
memory/4908-3-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/4908-4-0x0000000000B00000-0x0000000000B07000-memory.dmp

Filesize
28KB

Download