raccoon | 44bc9b5ec0d573cb94869694eb76a9f9b50e35d2c678b42069d5fb4a014d9da6

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe
Size

539KB
MD5

3aaef1dac507a2c62a8a35420bba366e
SHA1

2c2f47e1e05203c852646a44a7ed420ad9ea5afa
SHA256

44bc9b5ec0d573cb94869694eb76a9f9b50e35d2c678b42069d5fb4a014d9da6
SHA512

89219034c4b5b2f6c94ec2b10175358cb97653217c4e647210a6e2c9f1100b5eddab16ded7e274c680645846b3ebcfe03004e193e840c3bda0b305ac001b921e
SSDEEP

12288:3aPCGxIKAKXD0sfE90Ac5ddGac27GNR/Cy+l9:PaosfEyJGJGG3Kf9

Score

10^/10

raccoon 93f8b7c053c38cf658e833ccd257c4cb9233760d discovery stealer upx

Malware Config

Extracted

Family

raccoon

Version

1.7.2

Botnet

93f8b7c053c38cf658e833ccd257c4cb9233760d

Attributes

url4cnc
https://telete.in/baudemars

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2336-2-0x0000000004880000-0x0000000004912000-memory.dmp	family_raccoon_v1
behavioral1/memory/2336-3-0x0000000000400000-0x0000000000494000-memory.dmp	family_raccoon_v1
behavioral1/memory/2336-4-0x0000000000400000-0x0000000004805000-memory.dmp	family_raccoon_v1
behavioral1/memory/2336-5-0x0000000004880000-0x0000000004912000-memory.dmp	family_raccoon_v1

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x0000000004805000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aaef1dac507a2c62a8a35420bba366e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x0000000004805000-memory.dmp

Filesize
68.0MB

Download
memory/2336-2-0x0000000004880000-0x0000000004912000-memory.dmp

Filesize
584KB

Download
memory/2336-1-0x00000000003B0000-0x0000000000400000-memory.dmp

Filesize
320KB

Download
memory/2336-3-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2336-4-0x0000000000400000-0x0000000004805000-memory.dmp

Filesize
68.0MB

Download
memory/2336-5-0x0000000004880000-0x0000000004912000-memory.dmp

Filesize
584KB

Download