raccoon | e5e923e4bc5b56bc8d6c40da399419f959facc886c5264eb382af4eb17c316ef

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_05b3178700c7f8e60b17fbf3022a95b3.exe
Size

512KB
MD5

05b3178700c7f8e60b17fbf3022a95b3
SHA1

3bfe1b561fb10ba2783dd9f3f28bbd97681e2e95
SHA256

e5e923e4bc5b56bc8d6c40da399419f959facc886c5264eb382af4eb17c316ef
SHA512

f751aac881d27ea49f9a95a23fd52f15b1ef2bd16e9a4d5d0cb1ca306850cddad6c48bba13354e5306de300b6f5bbd8f8dd94453afaa16d910e406b36a9f930f
SSDEEP

6144:nydl2g9K7regCUSifuZYYrXxuwPn6PTQ096NLAdr3uuJ5hWtENnIADG8elO:nUl2gc6UOZYYrgwPncQ0kEdr3uuGGxD3

Score

10^/10

raccoon ac738e6383a48d6a74aeab7c52ebcd50f76032ee discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

ac738e6383a48d6a74aeab7c52ebcd50f76032ee

Attributes

url4cnc
http://telegka.top/jdiamond13

http://telegin.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 6 IoCs

resource	yara_rule
behavioral2/memory/2044-1-0x0000000004BE0000-0x0000000004C6E000-memory.dmp	family_raccoon_v1
behavioral2/memory/2044-2-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/2044-5-0x0000000004BE0000-0x0000000004C6E000-memory.dmp	family_raccoon_v1
behavioral2/memory/2044-4-0x0000000000400000-0x0000000002F46000-memory.dmp	family_raccoon_v1
behavioral2/memory/2044-6-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/2044-9-0x0000000000400000-0x0000000002F46000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_05b3178700c7f8e60b17fbf3022a95b3.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05b3178700c7f8e60b17fbf3022a95b3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05b3178700c7f8e60b17fbf3022a95b3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x00000000030C0000-0x000000000310E000-memory.dmp

Filesize
312KB

Download
memory/2044-1-0x0000000004BE0000-0x0000000004C6E000-memory.dmp

Filesize
568KB

Download
memory/2044-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2044-3-0x00000000030C0000-0x000000000310E000-memory.dmp

Filesize
312KB

Download
memory/2044-5-0x0000000004BE0000-0x0000000004C6E000-memory.dmp

Filesize
568KB

Download
memory/2044-4-0x0000000000400000-0x0000000002F46000-memory.dmp

Filesize
43.3MB

Download
memory/2044-6-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2044-9-0x0000000000400000-0x0000000002F46000-memory.dmp

Filesize
43.3MB

Download