raccoon | 4731988323a6211cbf619dd914868c507a1499ffbbd8f58386b8e3820e6c356a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d233b4bafc2d973cd3cdc3d9da5b4a43.exe
Size

594KB
MD5

d233b4bafc2d973cd3cdc3d9da5b4a43
SHA1

32df50fd9065d91c524e474e1a6c2521218e4a2e
SHA256

4731988323a6211cbf619dd914868c507a1499ffbbd8f58386b8e3820e6c356a
SHA512

7e0f73309ed1a721ee5c1a7a0de0c11b7dd0aeae97939bd7f540600e897d80343f96477098820e987a5dddf8b9519e28a0ea67482045524954b386c467a595a8
SSDEEP

12288:QdWaHaLp1QMuBIh72Bo2NlhmJIQHLPuX6fEnd2A+54XSPTiFXxzG42Esz:Qgz1QMWIVINlhmJrLWX6s2u2TEXxS

Score

10^/10

raccoon 1f80eb00f21640d6a48bbe0a818ba92698f728ce discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

1f80eb00f21640d6a48bbe0a818ba92698f728ce

Attributes

url4cnc
http://telegka.top/rockyrocket11

http://telegin.top/rockyrocket11

https://t.me/rockyrocket11

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/3560-2-0x0000000000D40000-0x0000000000DCE000-memory.dmp	family_raccoon_v1
behavioral2/memory/3560-3-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/3560-5-0x0000000000D40000-0x0000000000DCE000-memory.dmp	family_raccoon_v1
behavioral2/memory/3560-7-0x0000000000400000-0x0000000000491000-memory.dmp	family_raccoon_v1
behavioral2/memory/3560-6-0x0000000000400000-0x00000000008C3000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d233b4bafc2d973cd3cdc3d9da5b4a43.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d233b4bafc2d973cd3cdc3d9da5b4a43.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d233b4bafc2d973cd3cdc3d9da5b4a43.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3560-1-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/3560-2-0x0000000000D40000-0x0000000000DCE000-memory.dmp

Filesize
568KB

Download
memory/3560-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3560-4-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/3560-5-0x0000000000D40000-0x0000000000DCE000-memory.dmp

Filesize
568KB

Download
memory/3560-7-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3560-6-0x0000000000400000-0x00000000008C3000-memory.dmp

Filesize
4.8MB

Download