Overview

overview

10

Static

static

1

fe7131cf6c...18.exe

windows7-x64

10

fe7131cf6c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 04:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe7131cf6c341ca903692d41431a00cc_JaffaCakes118.exe

  • Size

    493KB

  • MD5

    fe7131cf6c341ca903692d41431a00cc

  • SHA1

    bf60c200a30d30fce85c142de2322e9ef67124e0

  • SHA256

    634f511eb76b80e93dda9725c78a7f81ce56e55d20f1a8054f158fa74474acfc

  • SHA512

    fdee53acc211562de78a4e3af0c7eb431d36937fba74dabf349c64ce1bc626b60af4a6570aa105dd3062c1baf0af108aa8397a0d31cd9b036ba7d6001573cda6

  • SSDEEP

    12288:1st56BjrelBW6dGC+SoeQkmRWEoLpSEijcSHTGhO:1stABnelNYSoeQkmRfoLJsjGhO

Score
10/10
raccoon5944ea4a7ef06637c8c156587128728b27948dd2stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

5944ea4a7ef06637c8c156587128728b27948dd2

Attributes
  • url4cnc

    https://telete.in/justoprostohello

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe7131cf6c341ca903692d41431a00cc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fe7131cf6c341ca903692d41431a00cc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\fe7131cf6c341ca903692d41431a00cc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fe7131cf6c341ca903692d41431a00cc_JaffaCakes118.exe
      2⤵
        PID:5028

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2024-0-0x0000000000C60000-0x0000000000CDE000-memory.dmp
      Filesize

      504KB

      Download
    • memory/2024-1-0x00000000752C0000-0x0000000075A70000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/2024-2-0x00000000057F0000-0x0000000005800000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2024-3-0x0000000001790000-0x00000000017B0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/2024-4-0x0000000005700000-0x0000000005776000-memory.dmp
      Filesize

      472KB

      Download
    • memory/2024-5-0x0000000005680000-0x000000000569E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/2024-9-0x00000000752C0000-0x0000000075A70000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/5028-6-0x0000000000400000-0x0000000000495000-memory.dmp
      Filesize

      596KB

      Download
    • memory/5028-7-0x0000000000400000-0x0000000000495000-memory.dmp
      Filesize

      596KB

      Download
    • memory/5028-10-0x0000000000400000-0x0000000000495000-memory.dmp
      Filesize

      596KB

      Download
    • memory/5028-11-0x0000000000400000-0x0000000000495000-memory.dmp
      Filesize

      596KB

      Download