raccoon | 229e3a66dc45f2a203e26ff364669b43e28ab5fb9aa4c5d560fb30751d8d67f5

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56e898535905db881f877ee10efc4807_JaffaCakes118.exe
Size

503KB
MD5

56e898535905db881f877ee10efc4807
SHA1

5cd489732e7b8f4ae32eef64fb46e17ce5600b59
SHA256

229e3a66dc45f2a203e26ff364669b43e28ab5fb9aa4c5d560fb30751d8d67f5
SHA512

7426ad120a81de748d2bfc1f9e107b03100beeb50dc25fe61c4c37ab3446f29bf22f930035d58b3d3225fea306ff6023f9ea97ae8abea5b32f75186cf3082d28
SSDEEP

12288:lZRci2MekWbmZcAIMOAtPQZl7aBjOQZ5i7I:lbxWbSFOgQLaJOB7I

Score

10^/10

raccoon 83fbe81dd43f775dd8af3cd619f88f428fbd9a96 discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

83fbe81dd43f775dd8af3cd619f88f428fbd9a96

Attributes

url4cnc
https://telete.in/opa4kiprivatem

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2936-2-0x0000000004A80000-0x0000000004B13000-memory.dmp	family_raccoon_v1
behavioral2/memory/2936-3-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2936-5-0x0000000004A80000-0x0000000004B13000-memory.dmp	family_raccoon_v1
behavioral2/memory/2936-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2936-6-0x0000000000400000-0x0000000002CB4000-memory.dmp	family_raccoon_v1

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3700	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
5100	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
3232	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
5040	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
3812	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
3540	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe
3632	2936	WerFault.exe	56e898535905db881f877ee10efc4807_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

56e898535905db881f877ee10efc4807_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56e898535905db881f877ee10efc4807_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56e898535905db881f877ee10efc4807_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\56e898535905db881f877ee10efc4807_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\56e898535905db881f877ee10efc4807_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 740
  2⤵
  - Program crash
  PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 776
  2⤵
  - Program crash
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 792
  2⤵
  - Program crash
  PID:3232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 804
  2⤵
  - Program crash
  PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 1204
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 876
  2⤵
  - Program crash
  PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 1200
  2⤵
  - Program crash
  PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2936 -ip 2936
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2936 -ip 2936
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2936 -ip 2936
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2936 -ip 2936
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2936 -ip 2936
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2936 -ip 2936
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2936 -ip 2936
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-2-0x0000000004A80000-0x0000000004B13000-memory.dmp

Filesize
588KB

Download
memory/2936-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/2936-3-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2936-4-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/2936-5-0x0000000004A80000-0x0000000004B13000-memory.dmp

Filesize
588KB

Download
memory/2936-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2936-6-0x0000000000400000-0x0000000002CB4000-memory.dmp

Filesize
40.7MB

Download