raccoon | e92765e6d0103f62113fa93e2c1be8e98df014bdf70d7a67a2f58afa99d9b977

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f64e52165e8b2fd9eed789971ec941a_JaffaCakes118.exe
Size

542KB
MD5

0f64e52165e8b2fd9eed789971ec941a
SHA1

b94c460776a48954181814ca3c8f9bebe1e9beb5
SHA256

e92765e6d0103f62113fa93e2c1be8e98df014bdf70d7a67a2f58afa99d9b977
SHA512

a614b43be33917974d313c236a5a6c1bd4334a2ac7703b34a2887341c152c91168cc60d7c6663105ba744dc7b4a0e03f9fd55a2c650ecb5199598cee00189b71
SSDEEP

12288:0snE+k3cLXmlPSMMMpe60MFzeg7X+AX1XOup9w:0uU3cLM1MV6vogbdDw

Score

10^/10

raccoon 59d412d4f41a89a59373ec4af49c5cc46ef2eed6 discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.1

Botnet

59d412d4f41a89a59373ec4af49c5cc46ef2eed6

Attributes

url4cnc
https://telete.in/hkeeplogup1

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-2-0x0000000002C40000-0x0000000002CD0000-memory.dmp	family_raccoon_v1
behavioral1/memory/2792-3-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/2792-5-0x0000000002C40000-0x0000000002CD0000-memory.dmp	family_raccoon_v1
behavioral1/memory/2792-7-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/2792-6-0x0000000000400000-0x0000000002BD0000-memory.dmp	family_raccoon_v1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0f64e52165e8b2fd9eed789971ec941a_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f64e52165e8b2fd9eed789971ec941a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0f64e52165e8b2fd9eed789971ec941a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f64e52165e8b2fd9eed789971ec941a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2792-2-0x0000000002C40000-0x0000000002CD0000-memory.dmp

Filesize
576KB

Download
memory/2792-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2792-4-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2792-5-0x0000000002C40000-0x0000000002CD0000-memory.dmp

Filesize
576KB

Download
memory/2792-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2792-6-0x0000000000400000-0x0000000002BD0000-memory.dmp

Filesize
39.8MB

Download