raccoon | a9edd7cee5010a9f5aa39bc0be68f8738fa6a537cafd5d07620be35f7126fb95

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22b0e4d2795842ca55381be2564911d5_JaffaCakes118.exe
Size

539KB
MD5

22b0e4d2795842ca55381be2564911d5
SHA1

c7489db36974addcbb711aefb4d9c9a8475c45a6
SHA256

a9edd7cee5010a9f5aa39bc0be68f8738fa6a537cafd5d07620be35f7126fb95
SHA512

27762e669ded32c21e07c2bebf00706f5f9697c7ab47e5eda1a7ebba826a532d06f55975cfb0bf3b73aa3db7a70b0fa7f3a1e793691a96a1ae748c157d80fe0d
SSDEEP

12288:SjtSQJCeGEOfoSrkIit/qA7FAQuXfmZG9X6AxKQAk:SjtLA91f3kX/qZQuXf79K8KQA

Score

10^/10

raccoon 93f8b7c053c38cf658e833ccd257c4cb9233760d discovery stealer upx

Malware Config

Extracted

Family

raccoon

Version

1.7.2

Botnet

93f8b7c053c38cf658e833ccd257c4cb9233760d

Attributes

url4cnc
https://telete.in/baudemars

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/1996-1-0x0000000004A90000-0x0000000004B22000-memory.dmp	family_raccoon_v1
behavioral2/memory/1996-3-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1
behavioral2/memory/1996-4-0x0000000000400000-0x0000000004805000-memory.dmp	family_raccoon_v1
behavioral2/memory/1996-5-0x0000000004A90000-0x0000000004B22000-memory.dmp	family_raccoon_v1
behavioral2/memory/1996-7-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1996-0-0x0000000000400000-0x0000000004805000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22b0e4d2795842ca55381be2564911d5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\22b0e4d2795842ca55381be2564911d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22b0e4d2795842ca55381be2564911d5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-0-0x0000000000400000-0x0000000004805000-memory.dmp

Filesize
68.0MB

Download
memory/1996-1-0x0000000004A90000-0x0000000004B22000-memory.dmp

Filesize
584KB

Download
memory/1996-2-0x0000000004A40000-0x0000000004A90000-memory.dmp

Filesize
320KB

Download
memory/1996-3-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1996-4-0x0000000000400000-0x0000000004805000-memory.dmp

Filesize
68.0MB

Download
memory/1996-5-0x0000000004A90000-0x0000000004B22000-memory.dmp

Filesize
584KB

Download
memory/1996-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download