raccoon | c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 21:02

Target

06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
Size

528KB
MD5

06103116cbf15dd1740e742a38b208f9
SHA1

250493f5cdb7d55334bde05281765d782fc84339
SHA256

c3254d5e509aebef7fda585b67b455028f7a64ecf1608285689f1a6f11767eb5
SHA512

66d7cf524ba590e22777733bde196e06db9d2d65641552c4fd0c5b16cf62421b820c95a869bc67ee5c5b02ac18ded154a3a79cf4d7a45824784848af7076e58e
SSDEEP

12288:cMfuxXbCLPTbTXqkrOIIXNuLV7JJKieFgJO7Cio:m0TTxSII9ufJKieF2OW

Score

10^/10

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-2-0x00000000002A0000-0x0000000000329000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-3-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-4-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon_v1
behavioral1/memory/1728-7-0x00000000002A0000-0x0000000000329000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 drive.google.com
3 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 1728 WerFault.exe 06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe

flow	ioc
2	drive.google.com
3	drive.google.com

pid	pid_target	process	target process
2900	1728	WerFault.exe	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe

description	pid	process	target process
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	WerFault.exe
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	WerFault.exe
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	WerFault.exe
PID 1728 wrote to memory of 2900	1728	06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06103116cbf15dd1740e742a38b208f9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 348
2⤵
- Program crash
PID:2900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

memory/1728-1-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1728-2-0x00000000002A0000-0x0000000000329000-memory.dmp

Filesize
548KB

Download
memory/1728-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1728-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1728-6-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1728-7-0x00000000002A0000-0x0000000000329000-memory.dmp

Filesize
548KB

Download