raccoon | bf5884d6d1d6bb564de362189ca4857ba1ef1d49a81669a8230f37bcad8d5829

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c21efa267e094c4dad927c976bc94c31.exe
Size

512KB
MD5

c21efa267e094c4dad927c976bc94c31
SHA1

48b4db86e22a916df21b8b1b106e1f17b2968ba0
SHA256

bf5884d6d1d6bb564de362189ca4857ba1ef1d49a81669a8230f37bcad8d5829
SHA512

28e16901175d79431c273eded4b7ffc6212f5663a716dd66eb42a4ae3765bdcdb8161b2a893c0e8500e0123d08e9e4e9222e563a21343ae07643266d6bb41c30
SSDEEP

12288:AkuuSP4H1DZXw6/yEMAmXDq54PWCks2D/FAvfSvwZGEX8cP:AtlCbbK1DzXPWnTFafSosEN

Score

10^/10

raccoon 887a0ffaca448362277f2227182491216b734133 discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

887a0ffaca448362277f2227182491216b734133

Attributes

url4cnc
http://telegka.top/jdiamond13

http://telegin.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 6 IoCs

resource	yara_rule
behavioral2/memory/412-1-0x0000000004D00000-0x0000000004D8E000-memory.dmp	family_raccoon_v1
behavioral2/memory/412-2-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/412-3-0x0000000000400000-0x0000000002F47000-memory.dmp	family_raccoon_v1
behavioral2/memory/412-5-0x0000000004D00000-0x0000000004D8E000-memory.dmp	family_raccoon_v1
behavioral2/memory/412-6-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/412-9-0x0000000000400000-0x0000000002F47000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c21efa267e094c4dad927c976bc94c31.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c21efa267e094c4dad927c976bc94c31.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c21efa267e094c4dad927c976bc94c31.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-0-0x0000000004C90000-0x0000000004CDE000-memory.dmp

Filesize
312KB

Download
memory/412-1-0x0000000004D00000-0x0000000004D8E000-memory.dmp

Filesize
568KB

Download
memory/412-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/412-4-0x0000000004C90000-0x0000000004CDE000-memory.dmp

Filesize
312KB

Download
memory/412-3-0x0000000000400000-0x0000000002F47000-memory.dmp

Filesize
43.3MB

Download
memory/412-5-0x0000000004D00000-0x0000000004D8E000-memory.dmp

Filesize
568KB

Download
memory/412-6-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/412-9-0x0000000000400000-0x0000000002F47000-memory.dmp

Filesize
43.3MB

Download