raccoon | efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8

Resubmissions

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Size

2.0MB
MD5

6e230b9cff0edf73241c6937260ce5f1
SHA1

24575f7c562b2e6d9c14919a1feb3cce2c4328f8
SHA256

efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8
SHA512

0eb73a779f207cf3f78244b6014e5febc4ed06652cf45eaaea6798e26fa057eb5dd4799833a7e244d08d717d6a591ca5f84b999004820a0735f5c528baa087c0
SSDEEP

24576:ku6Jx3O0c+JY5UZ+XC0kGso/WaaaiPOBSBYEXz88Om8Lz9jb+pWZI0oYZQuEWYvH:eI0c++OCvkGsUWay0LYvH

Score

10^/10

raccoon dc276e119d9a4d74f954a04ada4178a488e1daac stealer

Malware Config

Extracted

Family

raccoon

Botnet

dc276e119d9a4d74f954a04ada4178a488e1daac

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=19hM-KLCQYseROyH-iWgBUyp7N46KgncH

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

resource	yara_rule
behavioral2/memory/1376-3-0x0000000000810000-0x000000000089B000-memory.dmp	family_raccoon_v1
behavioral2/memory/1376-8-0x0000000000810000-0x000000000089B000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	1376	WerFault.exe	85

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1168
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1376 -ip 1376
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control