raccoon | 5f58de2b173fd83131e50888e3d355290b24a1b51da3c05f9c975b1524983d30

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe
Size

1020KB
MD5

35d9aa284dad273ae6ecc08992ffca84
SHA1

5b98344c8d89ca2831f3b02debb886477ef29725
SHA256

5f58de2b173fd83131e50888e3d355290b24a1b51da3c05f9c975b1524983d30
SHA512

945dec522ae892f1dbbfb9536a8548c641babe126762bfe8e37da0972933a43e4e4dd37744e5f7ea953f7c2a059dac988114a2db10e7f9d4a1ec8b79d1b7d4eb
SSDEEP

24576:om4c3+VbG0AOOy8G+2PMpOYoYm+FArWQdk:tcs0lOw+2PMpOYo1AA

Score

10^/10

raccoon d7b6e0cee1cd813ad40c812cf45171cf0360e249 discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

d7b6e0cee1cd813ad40c812cf45171cf0360e249

Attributes

url4cnc
https://telete.in/mimipanera11

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/2972-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2972-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2972-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2972-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29
PID 3004 wrote to memory of 2972	3004	35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\35d9aa284dad273ae6ecc08992ffca84_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2972-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2972-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2972-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3004-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/3004-1-0x0000000000F90000-0x0000000001092000-memory.dmp

Filesize
1.0MB

Download
memory/3004-2-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-3-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/3004-4-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-5-0x0000000000550000-0x0000000000578000-memory.dmp

Filesize
160KB

Download
memory/3004-10-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download