raccoon | 3df5633a05740e0e3d2ce9b861dc7a1473ec82a937ac6a8b7ef7519327ed551c

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe
Size

1.2MB
MD5

456b5e16067cb51809bb685cb355208a
SHA1

a7863fc6d8ad07523d19474922bf8da42f558373
SHA256

3df5633a05740e0e3d2ce9b861dc7a1473ec82a937ac6a8b7ef7519327ed551c
SHA512

78f0d72ba25f81cd041b286ae1889fb18b068eba5c0dea6df2c88acb9f304c95b377523bc26976eb9d4bc4e65d74766f32ebb71d25384a8391e617c606f96e0b
SSDEEP

24576:FczvENEiUOkTsJe85M1QdoXJ9Ut3WZdyLZRchgqDaXQrPYA1wBBAmat67Q:0Fhydel1wjAQk

Score

10^/10

raccoon 801037cd451aff6e52efd64bf0a5f82074753f90 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.2

Botnet

801037cd451aff6e52efd64bf0a5f82074753f90

Attributes

url4cnc
https://telete.in/jdex02000111

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/1108-2-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1
behavioral2/memory/1108-1-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1
behavioral2/memory/1108-4-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1
behavioral2/memory/1108-5-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85
PID 1076 wrote to memory of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85
PID 1076 wrote to memory of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85
PID 1076 wrote to memory of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85
PID 1076 wrote to memory of 1108	1076	456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\456b5e16067cb51809bb685cb355208a_JaffaCakes118.exe"
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1076-3-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1108-2-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1108-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1108-4-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1108-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download