raccoon | fe7c9093446f4bdd5cf993e91b0a6c42780cfac8d4d71dfdbb3c565e633f767f

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe
Size

615KB
MD5

efe92ca1be0addb4fc98740c3433e6b8
SHA1

571ce44d048685634d3c80254fbd05f6951bf35b
SHA256

fe7c9093446f4bdd5cf993e91b0a6c42780cfac8d4d71dfdbb3c565e633f767f
SHA512

b6fbf86607ba6aa648b29c74bb3fef34c32894c1aa7bdf79aad0849572f74199528b2c58e3a550897b0805745cb38bf3b4da59dc0d2adb216bc6e29918cf5449
SSDEEP

12288:MIWNUtkWj/SVSuArvtADZv3ElWnVuL9h1pBQG2Rb6Ftr9roPr:oUt1j/n91A1vLnVuLDBIpyV9ro

Score

10^/10

raccoon 843df8e07013ab494bdde13887b781a28c18cfec discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

843df8e07013ab494bdde13887b781a28c18cfec

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1-0SEcuREucC1-k5HBGE8sGu9Fz1AExrZ

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2216-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_raccoon_v1
behavioral1/memory/2216-5-0x0000000000400000-0x0000000000477000-memory.dmp	family_raccoon_v1
behavioral1/memory/2216-4-0x0000000000400000-0x0000000000993000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
2	drive.google.com
3	drive.google.com

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2848	2216	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2216 wrote to memory of 2848	2216	efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2848	2216	efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2848	2216	efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2848	2216	efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 328
  2⤵
  - Program crash
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/2216-1-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/2216-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2216-3-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/2216-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2216-4-0x0000000000400000-0x0000000000993000-memory.dmp

Filesize
5.6MB

Download