raccoon | 1524aaa7ee36630728f79d15833976bc6edadb05dbb8bafd98c0c25429e48dcb

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0471c4599670b397af2cef43bdd5b3b_JaffaCakes118.exe
Size

612KB
MD5

e0471c4599670b397af2cef43bdd5b3b
SHA1

49e33a6912167dbae9290ec170f52182fef551a2
SHA256

1524aaa7ee36630728f79d15833976bc6edadb05dbb8bafd98c0c25429e48dcb
SHA512

59af379954640499ec0883adb571488b61872178fbc0538134eef94667679f14379762fb38d14b933b92c50317086b0fa50b03ea941872a33f7f0bea73e74f45
SSDEEP

12288:dTtrzZH2BcnjHSu6w7WCA5NV4Npz+vzSHWxrc:bXZjgH5NVwP4

Score

10^/10

raccoon 87188f9569ec8981b502a8696353357862c7a96d discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

87188f9569ec8981b502a8696353357862c7a96d

Attributes

url4cnc
https://telete.in/fsdhelloagain

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral1/memory/2072-2-0x0000000003410000-0x00000000034A3000-memory.dmp	family_raccoon_v1
behavioral1/memory/2072-3-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2072-5-0x0000000003410000-0x00000000034A3000-memory.dmp	family_raccoon_v1
behavioral1/memory/2072-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2072-6-0x0000000000400000-0x0000000003336000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0471c4599670b397af2cef43bdd5b3b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e0471c4599670b397af2cef43bdd5b3b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0471c4599670b397af2cef43bdd5b3b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2072-2-0x0000000003410000-0x00000000034A3000-memory.dmp

Filesize
588KB

Download
memory/2072-3-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2072-4-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2072-5-0x0000000003410000-0x00000000034A3000-memory.dmp

Filesize
588KB

Download
memory/2072-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2072-6-0x0000000000400000-0x0000000003336000-memory.dmp

Filesize
47.2MB

Download