raccoon | f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Size

1.2MB
MD5

794fd53672ca4d097d20087993d8c5ec
SHA1

6535b5046659ff169ba0f60d83416398b54be518
SHA256

f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191
SHA512

88542d21075f88b9213d47c71263246351fd6a0b475ce9606975a7242eace88422beaafe6c7af97bf4e892c3703a55115753e54753ed739d58406304555b1ca5
SSDEEP

12288:bUtSe4izalBUu01gTL5vBFWJKRlQH8OrNeXg85hlrv+5RQLH5n8YfjgzEhal8Qpe:bUU3kM0OllQcOrggylgR4B0gsl/pN5Z

Score

10^/10

raccoon 1efa8bc342e6231de758bd380849cb5c0fe63cda stealer

Malware Config

Extracted

Family

raccoon

Botnet

1efa8bc342e6231de758bd380849cb5c0fe63cda

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1GHkkOFIb-WQAfra8RoDiA0vdpNIMBugL

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral2/memory/1900-11-0x0000000000400000-0x0000000000477000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	drive.google.com
32	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	98

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	1900	WerFault.exe	98

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Token: 33	4232	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4232	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	98
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	98
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	98
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 1132
    3⤵
    - Program crash
    PID:2648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1900 -ip 1900
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-11-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3176-1-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download
memory/3176-2-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-3-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-4-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-5-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-6-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-7-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-8-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-9-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3176-10-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download