Overview

overview

10

Static

static

3

d150af36f2...18.exe

windows7-x64

10

d150af36f2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 06:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d150af36f2f3491f0c5f494a955cbd3a_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    d150af36f2f3491f0c5f494a955cbd3a

  • SHA1

    985e5116c2236240339502e3473e5dc7a1345b30

  • SHA256

    adb4772d8d5f9ede7d8b52b1beb66db50b616e97d30231290240dbd9cda75b3e

  • SHA512

    33e14c7fd573853341eaaa5c222e441c21d21ad925d031ed7dd1db7fa25eb30af5995797c3f016dee28f99b15adb84c542cb0e7485be7d17a51afc65694bd101

  • SSDEEP

    49152:if9Q234inibHWwqq8tRcFcQXoXxxqO9zt1f5f0O:q9Q234bbe1yO

Score
10/10
raccoond0d8f0c05443081efeb9aa7979b1b9207fcc6052discoverystealer

Malware Config

Extracted

Family

raccoon

Botnet

d0d8f0c05443081efeb9aa7979b1b9207fcc6052

Attributes
  • url4cnc

    https://drive.google.com/uc?export=download&id=1EBSoPDLupsO6YQpzXcIO7q-Fk8VXBPgi

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d150af36f2f3491f0c5f494a955cbd3a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d150af36f2f3491f0c5f494a955cbd3a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\AppData\Local\Temp\d150af36f2f3491f0c5f494a955cbd3a_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d150af36f2f3491f0c5f494a955cbd3a_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1140
        3⤵
        • Program crash
        PID:4792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2544 -ip 2544
    1⤵
      PID:2000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2544-2-0x0000000000400000-0x000000000048A000-memory.dmp

      Filesize

      552KB

      Download

    • memory/2816-0-0x0000000003490000-0x00000000034C4000-memory.dmp

      Filesize

      208KB

      Download

    • memory/2816-1-0x0000000003490000-0x00000000034C4000-memory.dmp

      Filesize

      208KB

      Download