raccoon | 42b5e1b39fbd5952799a83c063617e0c1010447bffce1bec27ef5e331848aa67

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:49

Target

8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe
Size

675KB
MD5

8ec29972dfd9a10e3da2c9ee240cc755
SHA1

5980b3c0314fc20f5ac6f3db31bbed41192c193a
SHA256

42b5e1b39fbd5952799a83c063617e0c1010447bffce1bec27ef5e331848aa67
SHA512

7432c3fc1afcf3ea8562c744d0bb750badc52a25e3fd1e3cbeb4cbf4e4e2c4e23f16200ee45cb1d3e3ce2ca7524f0330dfe239bdc25d5faa9a2cd37f8f9a1120
SSDEEP

12288:ct1HXw/XtrzgoB0+XDzGw1GADmB7hGsr0T6+wUbxGVnvrHf2k:PXaoBQsdmusr0DbxGVvrOk

Score

10^/10

Family

raccoon

Botnet

218710f63bc498a79834837a7fbeda5d33dd357c

Attributes

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/4132-9-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/4132-10-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/4132-13-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/4132-12-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/4132-15-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 116 set thread context of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92
PID 116 wrote to memory of 4132	116	8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\8ec29972dfd9a10e3da2c9ee240cc755_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:4132

memory/116-6-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/116-8-0x0000000006520000-0x0000000006AC4000-memory.dmp

Filesize
5.6MB

Download
memory/116-2-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/116-3-0x00000000055C0000-0x00000000055C8000-memory.dmp

Filesize
32KB

Download
memory/116-4-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/116-5-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/116-1-0x0000000000BE0000-0x0000000000C90000-memory.dmp

Filesize
704KB

Download
memory/116-7-0x0000000005DD0000-0x0000000005E6E000-memory.dmp

Filesize
632KB

Download
memory/116-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/116-14-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4132-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4132-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4132-13-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4132-12-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4132-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download