raccoon | c3236aee6db7f0f80eb9df9761afd6aff45edcb527c7deb9048c46e6cc84f454

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2e7ecfe9b6cf170c73540e348009f178.exe
Size

513KB
MD5

2e7ecfe9b6cf170c73540e348009f178
SHA1

97bb8284353f0eb0ee86c23f98d1249fec2cbcd7
SHA256

c3236aee6db7f0f80eb9df9761afd6aff45edcb527c7deb9048c46e6cc84f454
SHA512

0f5fbc0a39b06e49f7fdb6b80ac1764a2cb15a79b34ab8a70124364149a9d5f4da60d398b413c03a084dfa2c0b63b7a201e3fe1c8100b0f070866bed204bc91c
SSDEEP

12288:3E4P+bYnH/tvQKU4xvZr2mmF286h4cuNoampNj:3r+UH/qKZr5ZCo1

Score

10^/10

raccoon 723d14b565e8f39294f31f86b0ce56cdaee75105 discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

723d14b565e8f39294f31f86b0ce56cdaee75105

Attributes

url4cnc
http://telegatt.top/jdiamond13

http://telegka.top/jdiamond13

http://telegin.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 6 IoCs

resource	yara_rule
behavioral1/memory/2148-2-0x0000000000330000-0x00000000003BE000-memory.dmp	family_raccoon_v1
behavioral1/memory/2148-3-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral1/memory/2148-6-0x0000000000330000-0x00000000003BE000-memory.dmp	family_raccoon_v1
behavioral1/memory/2148-5-0x0000000000400000-0x00000000007B2000-memory.dmp	family_raccoon_v1
behavioral1/memory/2148-7-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral1/memory/2148-16-0x0000000000400000-0x00000000007B2000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2e7ecfe9b6cf170c73540e348009f178.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7ecfe9b6cf170c73540e348009f178.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7ecfe9b6cf170c73540e348009f178.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-1-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2148-2-0x0000000000330000-0x00000000003BE000-memory.dmp

Filesize
568KB

Download
memory/2148-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2148-4-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2148-6-0x0000000000330000-0x00000000003BE000-memory.dmp

Filesize
568KB

Download
memory/2148-5-0x0000000000400000-0x00000000007B2000-memory.dmp

Filesize
3.7MB

Download
memory/2148-7-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2148-16-0x0000000000400000-0x00000000007B2000-memory.dmp

Filesize
3.7MB

Download