raccoon | fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762.exe
Size

715.0MB
MD5

adb7ace5b740fd7c83cd3e803d14bc10
SHA1

a612de801f1bd0ddd5071792897f7fa01072be96
SHA256

fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762
SHA512

0134c33c384ff8ff7a5c463ed24c839824df23d7bccb6a46589f524f3e7a0cdd1fa2abc5dce89700cebf25a66723cc8ae6bac704a4fbd8d757b5de40ef960449
SSDEEP

49152:Igd/cfSU9z7mpES+tsoZTenHnnME2VDfaoy1fvrySJKRUrKb8Cop5Iu4I533+cBS:IgGfdhAnME2HSYUrdEI56R

Score

10^/10

raccoon 9f0d171e2e037518ce377bdfa9e0ec26 discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

9f0d171e2e037518ce377bdfa9e0ec26

http://77.73.133.0/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1244cd2b42eebe3c87f9b89aa08a49c663ad30d897cbe7bb794263e6899762.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000002540000-0x0000000002558000-memory.dmp

Filesize
96KB

Download
memory/1860-1-0x000000000E1D0000-0x000000000E1E3000-memory.dmp

Filesize
76KB

Download
memory/1860-2-0x0000000000400000-0x00000000007DB000-memory.dmp

Filesize
3.9MB

Download
memory/1860-3-0x0000000002540000-0x0000000002558000-memory.dmp

Filesize
96KB

Download
memory/1860-4-0x000000000E1D0000-0x000000000E1E3000-memory.dmp

Filesize
76KB

Download