raccoon | 1da8e2355f5c217c5e142b1ce9a2f9e9599b06025787602ccdae02bad06bf36c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:19

Target

fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
Size

513KB
MD5

fd8ff1c8618ccfc9a11fab1980c849bd
SHA1

c1f9c63fada0b2de6f5f42a5a6f5e2d32b79dccd
SHA256

1da8e2355f5c217c5e142b1ce9a2f9e9599b06025787602ccdae02bad06bf36c
SHA512

c7e42c8410246f01a410005a9a1706b532458581dbe68680fe47015ce504410aecd29ed94b26d4348a2417d9fa9ea5527f3cac695fa4fef2b66620cc8b7493e9
SSDEEP

12288:1irZ3mcxsLZe/ZasZrOEMugcVjySfRS4zcsKLmn:14Fmcx7rMudVvbQLmn

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

0b83cb02a824f2d53c99cfc8fd4a2d84bbe799ea

Attributes

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1152-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-10-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1152-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

description	pid	process	target process
PID 3604 set thread context of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3604 fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

description	pid	process	target process
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
PID 3604 wrote to memory of 1152	3604	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe	fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fd8ff1c8618ccfc9a11fab1980c849bd_JaffaCakes118.exe
2⤵
PID:1152

memory/1152-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1152-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3604-0-0x0000000000FF0000-0x0000000001074000-memory.dmp

Filesize
528KB

Download
memory/3604-1-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/3604-2-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3604-3-0x0000000003320000-0x0000000003340000-memory.dmp

Filesize
128KB

Download
memory/3604-4-0x0000000005A80000-0x0000000005AF6000-memory.dmp

Filesize
472KB

Download
memory/3604-5-0x0000000005A10000-0x0000000005A2E000-memory.dmp

Filesize
120KB

Download
memory/3604-9-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download