raccoon | 942353c71456ab1a0448ae9ea161cdb10cf85770e577d39c2f660193bc3efe9b

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_787d7fe12ead5fc31da3ac6d5bb4e1e5.exe
Size

567KB
MD5

787d7fe12ead5fc31da3ac6d5bb4e1e5
SHA1

c8b8921b95548ca5bfdb3aeaae6829b07a160064
SHA256

942353c71456ab1a0448ae9ea161cdb10cf85770e577d39c2f660193bc3efe9b
SHA512

bcdb85113b1a0616cf4d0b2183ce1522267fb3f4dc4dd71603c766011f82b17b5ccf7d4a76945f7350670107091673f9a6b4e2ffb78482780f8953ecc9f168c8
SSDEEP

12288:DHazHW9ypodExl1Sb/7npw20tZJhTTlafwX6A/G1RO:DHabppyE3e/7pwhPFBKCG3

Score

10^/10

raccoon a88535c74ffd32b2b194b8f5512e3cc6a1ebc76a discovery stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.2

Botnet

a88535c74ffd32b2b194b8f5512e3cc6a1ebc76a

Attributes

url4cnc
http://telemirror.top/hellobyegain

http://tgmirror.top/hellobyegain

http://telegatt.top/hellobyegain

http://telegka.top/hellobyegain

http://telegin.top/hellobyegain

https://t.me/hellobyegain

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral1/memory/1156-2-0x0000000000350000-0x00000000003DE000-memory.dmp	family_raccoon_v1
behavioral1/memory/1156-3-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral1/memory/1156-6-0x0000000000350000-0x00000000003DE000-memory.dmp	family_raccoon_v1
behavioral1/memory/1156-5-0x0000000000400000-0x0000000002DE5000-memory.dmp	family_raccoon_v1
behavioral1/memory/1156-7-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_787d7fe12ead5fc31da3ac6d5bb4e1e5.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_787d7fe12ead5fc31da3ac6d5bb4e1e5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_787d7fe12ead5fc31da3ac6d5bb4e1e5.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-1-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

Filesize
1024KB

Download
memory/1156-2-0x0000000000350000-0x00000000003DE000-memory.dmp

Filesize
568KB

Download
memory/1156-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1156-4-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

Filesize
1024KB

Download
memory/1156-6-0x0000000000350000-0x00000000003DE000-memory.dmp

Filesize
568KB

Download
memory/1156-5-0x0000000000400000-0x0000000002DE5000-memory.dmp

Filesize
41.9MB

Download
memory/1156-7-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download