raccoon | 3f6c6e27fba6e2622e761e40bd213fef67eae0ae34c1bb203d607d6cfc86a744

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe
Size

544KB
MD5

eb5b5c1aadbfcf4f77224f0ba54ea857
SHA1

fff6171533a856329881093dd0ace4aeebaa4aa9
SHA256

3f6c6e27fba6e2622e761e40bd213fef67eae0ae34c1bb203d607d6cfc86a744
SHA512

0547c53977d5bca129eb85b1f927a8ce57442fa028c9d0697c0c99e7b861bb31431df02ea7cd3ee5dda6a5621ee3e82c2255a535b96e112f31a8888d29b6ebdd
SSDEEP

12288:36DB7xHIF/+vGJ7h00tay5Xj8/7/SgkvhJTzSeehpTNqXvHKrh:3SB7RIkvGJdCQY/DS/DT90+XfKrh

Score

10^/10

raccoon 9cd318cbd9a92c7e7d1c2ecfc2e7ccb0e3187a77 stealer

Malware Config

Extracted

Family

raccoon

Botnet

9cd318cbd9a92c7e7d1c2ecfc2e7ccb0e3187a77

Attributes

url4cnc
https://telete.in/iphonemotorollex

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/3584-5-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3584-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3584-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3584-10-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3584-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100
PID 468 wrote to memory of 3584	468	eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eb5b5c1aadbfcf4f77224f0ba54ea857_JaffaCakes118.exe
  2⤵
  PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-0-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/468-1-0x0000000000D30000-0x0000000000DBA000-memory.dmp

Filesize
552KB

Download
memory/468-2-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/468-3-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/468-4-0x0000000005700000-0x0000000005728000-memory.dmp

Filesize
160KB

Download
memory/468-9-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/3584-5-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3584-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3584-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3584-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3584-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download