raccoon | 82d792b7e9a7047365047bb2429fd95e6d594733138526ca9535dc64193e1f66

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_127a59293cea70d7f375f5cf69b454d1.exe
Size

3.9MB
MD5

127a59293cea70d7f375f5cf69b454d1
SHA1

07984ae946e2263c85517cea17037dfd0a625fdd
SHA256

82d792b7e9a7047365047bb2429fd95e6d594733138526ca9535dc64193e1f66
SHA512

5ae054f89a7427920ab620394743c38f7f84bbf390a815a4f9734658da9760965dc2384c8a20bf25a9a4e6b8bbb415b45da5002ba3688f3005b305b8503fff29
SSDEEP

98304:O2TRt7UEr+IyIAsjbiynr68YE2iVzn2nw5JfNzfjBG:O+Rt7UEr+IyIb5gpiVzngmN

Score

10^/10

raccoon discovery stealer vmprotect

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x0000000000A14000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x0000000000A14000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_127a59293cea70d7f375f5cf69b454d1.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_127a59293cea70d7f375f5cf69b454d1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_127a59293cea70d7f375f5cf69b454d1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-0-0x0000000000400000-0x0000000000A14000-memory.dmp

Filesize
6.1MB

Download