raccoon | 07eb07c5d32d9dd6939d0db3a6858af59e1e173f643cb7af9bd360bc237dc119

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e11cbb1c6ea62b49b5b6b8cf3a0095_JaffaCakes118.exe
Size

3.6MB
MD5

22e11cbb1c6ea62b49b5b6b8cf3a0095
SHA1

b6302f4e7ec74eddc38ec35e603be51e88a73f14
SHA256

07eb07c5d32d9dd6939d0db3a6858af59e1e173f643cb7af9bd360bc237dc119
SHA512

00bba02dc10d3620b6ea68386a2c3fdb89eb87acf01a8ce3ca1abfcec10edf8eaf57c7fbc49b6eb18e556c18a2be95c1a3122ec1a2713fb6573771d4e0dea7b1
SSDEEP

98304:N+ztp4gTyt2pHvZr+Ec+junSOM7Yl0+hDJoUD:N+zMWygpRr+17SOM80CoM

Score

10^/10

raccoon discovery stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000110000-0x00000000006F0000-memory.dmp	family_raccoon_v1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22e11cbb1c6ea62b49b5b6b8cf3a0095_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\22e11cbb1c6ea62b49b5b6b8cf3a0095_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22e11cbb1c6ea62b49b5b6b8cf3a0095_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-0-0x0000000000110000-0x00000000006F0000-memory.dmp

Filesize
5.9MB

Download