raccoon | efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8

Resubmissions

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Size

2.0MB
MD5

6e230b9cff0edf73241c6937260ce5f1
SHA1

24575f7c562b2e6d9c14919a1feb3cce2c4328f8
SHA256

efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8
SHA512

0eb73a779f207cf3f78244b6014e5febc4ed06652cf45eaaea6798e26fa057eb5dd4799833a7e244d08d717d6a591ca5f84b999004820a0735f5c528baa087c0
SSDEEP

24576:ku6Jx3O0c+JY5UZ+XC0kGso/WaaaiPOBSBYEXz88Om8Lz9jb+pWZI0oYZQuEWYvH:eI0c++OCvkGsUWay0LYvH

Score

10^/10

raccoon dc276e119d9a4d74f954a04ada4178a488e1daac stealer

Malware Config

Extracted

Family

raccoon

Botnet

dc276e119d9a4d74f954a04ada4178a488e1daac

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=19hM-KLCQYseROyH-iWgBUyp7N46KgncH

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

resource	yara_rule
behavioral1/memory/2056-12-0x0000000000080000-0x000000000010B000-memory.dmp	family_raccoon_v1
behavioral1/memory/2056-4-0x0000000000080000-0x000000000010B000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
3	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2056	WerFault.exe	28

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	28
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	29
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	29
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	29
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 328
    3⤵
    - Program crash
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control