raccoon | 3683d5f3b4dbb6076ff5e8d6d6528e1a1a8987fed717eab3e96cb9809310c9f1

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe
Size

511KB
MD5

15a6ceab14602e5972efc127145460ff
SHA1

0fd6c0eeda03c5650b41a078614ea8af6adb4c81
SHA256

3683d5f3b4dbb6076ff5e8d6d6528e1a1a8987fed717eab3e96cb9809310c9f1
SHA512

689c3d6fa4f714b22473b05d18b8feadb73bc1b48b744816c85889c9c0b152ad164019c65458e82af6cf769c51c43ae82f79c3c904d74494dbe85f05a96f71af
SSDEEP

12288:+sSm11Kq6B9PtohNY2U21KwWdWZdEL2ReL9C5iF:+sSm7KHP+NY2U1Ck9

Score

10^/10

raccoon 39b871ed120e56ecbdc546b8a8a78c4e5516bc1f discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

39b871ed120e56ecbdc546b8a8a78c4e5516bc1f

Attributes

url4cnc
https://telete.in/uiopoppiscess

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-2-0x0000000000310000-0x00000000003A3000-memory.dmp	family_raccoon_v1
behavioral1/memory/2888-3-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2888-5-0x0000000000310000-0x00000000003A3000-memory.dmp	family_raccoon_v1
behavioral1/memory/2888-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2888-6-0x0000000000400000-0x0000000002CB5000-memory.dmp	family_raccoon_v1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15a6ceab14602e5972efc127145460ff_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-1-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Filesize
1024KB

Download
memory/2888-2-0x0000000000310000-0x00000000003A3000-memory.dmp

Filesize
588KB

Download
memory/2888-3-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2888-4-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Filesize
1024KB

Download
memory/2888-5-0x0000000000310000-0x00000000003A3000-memory.dmp

Filesize
588KB

Download
memory/2888-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2888-6-0x0000000000400000-0x0000000002CB5000-memory.dmp

Filesize
40.7MB

Download