raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

General

Target

f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
Size

629KB
MD5

f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1

64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA256

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
SHA512

029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8
SSDEEP

12288:6WGdbu38g1hhiyCCaXNQY0ERzcUKHYjzp489c93P7r9r/+ppppppppppppppppp6:6WKC8gXs7Cz89KHezKv1qzyb

Score

10^/10

raccoon e1705ddaac9f73881d2b3657a93827c883eac34f stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

url4cnc
https://telete.in/uidesopencardtop

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5004-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/5004-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/5004-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/5004-12-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/5004-13-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

description	pid	process	target process
PID 3288 set thread context of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3288 f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

description	pid	process	target process
PID 3288 wrote to memory of 5008	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5008	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5008	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
PID 3288 wrote to memory of 5004	3288	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe	f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288

C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
2⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12_JaffaCakes118.exe
2⤵
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-10-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3288-1-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3288-2-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3288-3-0x0000000004E00000-0x0000000004E76000-memory.dmp

Filesize
472KB

Download
memory/3288-4-0x0000000002940000-0x000000000295E000-memory.dmp

Filesize
120KB

Download
memory/3288-5-0x0000000002990000-0x00000000029A4000-memory.dmp

Filesize
80KB

Download
memory/3288-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/5004-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/5004-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/5004-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/5004-12-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/5004-13-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/5008-6-0x00000000003E0000-0x00000000003E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads