raccoon | 1da8e2355f5c217c5e142b1ce9a2f9e9599b06025787602ccdae02bad06bf36c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
Size

513KB
MD5

fd8ff1c8618ccfc9a11fab1980c849bd
SHA1

c1f9c63fada0b2de6f5f42a5a6f5e2d32b79dccd
SHA256

1da8e2355f5c217c5e142b1ce9a2f9e9599b06025787602ccdae02bad06bf36c
SHA512

c7e42c8410246f01a410005a9a1706b532458581dbe68680fe47015ce504410aecd29ed94b26d4348a2417d9fa9ea5527f3cac695fa4fef2b66620cc8b7493e9
SSDEEP

12288:1irZ3mcxsLZe/ZasZrOEMugcVjySfRS4zcsKLmn:14Fmcx7rMudVvbQLmn

Score

10^/10

raccoon 0b83cb02a824f2d53c99cfc8fd4a2d84bbe799ea stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

0b83cb02a824f2d53c99cfc8fd4a2d84bbe799ea

Attributes

url4cnc
https://telete.in/bibisberont

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/1152-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-10-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
  2⤵
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3604-0-0x0000000000FF0000-0x0000000001074000-memory.dmp

Filesize
528KB

Download
memory/3604-1-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/3604-2-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3604-3-0x0000000003320000-0x0000000003340000-memory.dmp

Filesize
128KB

Download
memory/3604-4-0x0000000005A80000-0x0000000005AF6000-memory.dmp

Filesize
472KB

Download
memory/3604-5-0x0000000005A10000-0x0000000005A2E000-memory.dmp

Filesize
120KB

Download
memory/3604-9-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download