raccoon | c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
Size

528KB
MD5

06103116cbf15dd1740e742a38b208f9
SHA1

250493f5cdb7d55334bde05281765d782fc84339
SHA256

c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5
SHA512

66d7cf524ba590e22777733bde196e06db9d2d65641552c4fd0c5b16cf62421b820c95a869bc67ee5c5b02ac18ded154a3a79cf4d7a45824784848af7076e58e
SSDEEP

12288:cMfuxXbCLPTbTXqkrOIIXNuLV7JJKieFgJO7Cio:m0TTxSII9ufJKieF2OW

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/1728-2-0x00000000002A0000-0x0000000000329000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-3-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-4-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-7-0x00000000002A0000-0x0000000000329000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
3	drive.google.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 348
  2⤵
  - Program crash
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-1-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1728-2-0x00000000002A0000-0x0000000000329000-memory.dmp

Filesize
548KB

Download
memory/1728-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1728-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1728-6-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1728-7-0x00000000002A0000-0x0000000000329000-memory.dmp

Filesize
548KB

Download