raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
Size

629KB
MD5

f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1

64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA256

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
SHA512

029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8
SSDEEP

12288:6WGdbu38g1hhiyCCaXNQY0ERzcUKHYjzp489c93P7r9r/+ppppppppppppppppp6:6WKC8gXs7Cz89KHezKv1qzyb

Score

10^/10

raccoon e1705ddaac9f73881d2b3657a93827c883eac34f stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

url4cnc
https://telete.in/uidesopencardtop

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral1/memory/2616-4-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28
PID 2956 wrote to memory of 2616	2956	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
  2⤵
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-4-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2956-0-0x00000000003E0000-0x0000000000480000-memory.dmp

Filesize
640KB

Download
memory/2956-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2956-2-0x00000000004B0000-0x00000000004F0000-memory.dmp

Filesize
256KB

Download
memory/2956-3-0x0000000000480000-0x0000000000494000-memory.dmp

Filesize
80KB

Download
memory/2956-6-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download