raccoon | c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
Size

528KB
MD5

06103116cbf15dd1740e742a38b208f9
SHA1

250493f5cdb7d55334bde05281765d782fc84339
SHA256

c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5
SHA512

66d7cf524ba590e22777733bde196e06db9d2d65641552c4fd0c5b16cf62421b820c95a869bc67ee5c5b02ac18ded154a3a79cf4d7a45824784848af7076e58e
SSDEEP

12288:cMfuxXbCLPTbTXqkrOIIXNuLV7JJKieFgJO7Cio:m0TTxSII9ufJKieF2OW

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/456-2-0x0000000000550000-0x00000000005D9000-memory.dmp	family_raccoon_v1
behavioral2/memory/456-3-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral2/memory/456-5-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral2/memory/456-6-0x0000000000550000-0x00000000005D9000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4344	456	WerFault.exe	83
2796	456	WerFault.exe	83
1780	456	WerFault.exe	83
3280	456	WerFault.exe	83
4608	456	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe"
1⤵
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 740
  2⤵
  - Program crash
  PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 776
  2⤵
  - Program crash
  PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 888
  2⤵
  - Program crash
  PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 868
  2⤵
  - Program crash
  PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 848
  2⤵
  - Program crash
  PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 456
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 456 -ip 456
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 456 -ip 456
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 456 -ip 456
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 456 -ip 456
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/456-2-0x0000000000550000-0x00000000005D9000-memory.dmp

Filesize
548KB

Download
memory/456-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/456-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/456-6-0x0000000000550000-0x00000000005D9000-memory.dmp

Filesize
548KB

Download