raccoon | 702311ddbba956e85b647184b2703264c13c90401df5b8c590b43fd34c1a4818

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe
Size

487KB
MD5

44fa5422adae2460aa931d93b45c078c
SHA1

4d1cff94b8fde9b255c3673c5ac34ab10b6caad4
SHA256

702311ddbba956e85b647184b2703264c13c90401df5b8c590b43fd34c1a4818
SHA512

8a3cc0fb2f9c14a2ac6e1766b324fd8c47fe1005cb76807b4c132bba7167972160a6891f9ab5d1ea730c823847b3ce442854d060590d4d617821038b386a1762
SSDEEP

12288:Cy23VyNohOGXKYmGxyT9RgDipky8aqzSXcc0KrbZv8YPpK:jAYO4GxygipDRq6l0Krb9lpK

Score

10^/10

raccoon fe582536ec580228180f270f7cb80a867860e010 discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

fe582536ec580228180f270f7cb80a867860e010

Attributes

url4cnc
https://telete.in/xylichanjk

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4164-2-0x0000000004950000-0x00000000049DF000-memory.dmp	family_raccoon_v1
behavioral2/memory/4164-3-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral2/memory/4164-5-0x0000000004950000-0x00000000049DF000-memory.dmp	family_raccoon_v1
behavioral2/memory/4164-7-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral2/memory/4164-6-0x0000000000400000-0x0000000002B84000-memory.dmp	family_raccoon_v1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44fa5422adae2460aa931d93b45c078c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4164-1-0x0000000002BD0000-0x0000000002CD0000-memory.dmp

Filesize
1024KB

Download
memory/4164-2-0x0000000004950000-0x00000000049DF000-memory.dmp

Filesize
572KB

Download
memory/4164-3-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4164-4-0x0000000002BD0000-0x0000000002CD0000-memory.dmp

Filesize
1024KB

Download
memory/4164-5-0x0000000004950000-0x00000000049DF000-memory.dmp

Filesize
572KB

Download
memory/4164-7-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4164-6-0x0000000000400000-0x0000000002B84000-memory.dmp

Filesize
39.5MB

Download