raccoon | f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Size

1.2MB
MD5

794fd53672ca4d097d20087993d8c5ec
SHA1

6535b5046659ff169ba0f60d83416398b54be518
SHA256

f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191
SHA512

88542d21075f88b9213d47c71263246351fd6a0b475ce9606975a7242eace88422beaafe6c7af97bf4e892c3703a55115753e54753ed739d58406304555b1ca5
SSDEEP

12288:bUtSe4izalBUu01gTL5vBFWJKRlQH8OrNeXg85hlrv+5RQLH5n8YfjgzEhal8Qpe:bUU3kM0OllQcOrggylgR4B0gsl/pN5Z

Score

10^/10

raccoon 1efa8bc342e6231de758bd380849cb5c0fe63cda stealer

Malware Config

Extracted

Family

raccoon

Botnet

1efa8bc342e6231de758bd380849cb5c0fe63cda

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1GHkkOFIb-WQAfra8RoDiA0vdpNIMBugL

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral1/memory/2556-9-0x0000000000400000-0x0000000000477000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
3	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2556	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2556	3068	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	28
PID 2556 wrote to memory of 2684	2556	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2684	2556	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2684	2556	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2684	2556	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 324
    3⤵
    - Program crash
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-9-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3068-1-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/3068-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-7-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3068-8-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download