raccoon | efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8

Resubmissions

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Size

2.0MB
MD5

6e230b9cff0edf73241c6937260ce5f1
SHA1

24575f7c562b2e6d9c14919a1feb3cce2c4328f8
SHA256

efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8
SHA512

0eb73a779f207cf3f78244b6014e5febc4ed06652cf45eaaea6798e26fa057eb5dd4799833a7e244d08d717d6a591ca5f84b999004820a0735f5c528baa087c0
SSDEEP

24576:ku6Jx3O0c+JY5UZ+XC0kGso/WaaaiPOBSBYEXz88Om8Lz9jb+pWZI0oYZQuEWYvH:eI0c++OCvkGsUWay0LYvH

Score

10^/10

raccoon dc276e119d9a4d74f954a04ada4178a488e1daac stealer

Malware Config

Extracted

Family

raccoon

Botnet

dc276e119d9a4d74f954a04ada4178a488e1daac

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=19hM-KLCQYseROyH-iWgBUyp7N46KgncH

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2056-12-0x0000000000080000-0x000000000010B000-memory.dmp	family_raccoon_v1
behavioral1/memory/2056-4-0x0000000000080000-0x000000000010B000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 drive.google.com
3 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

description pid process target process

PID 2292 set thread context of 2056 2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2916 2056 WerFault.exe 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid process

2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid process

2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

flow	ioc
2	drive.google.com
3	drive.google.com

description	pid	process	target process
PID 2292 set thread context of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	pid_target	process	target process
2916	2056	WerFault.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	process
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	process
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

description	pid	process	target process
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2292 wrote to memory of 2056	2292	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2916	2056	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 328
3⤵
- Program crash
PID:2916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-2-0x0000000000080000-0x000000000010B000-memory.dmp

Filesize
556KB

Download
memory/2056-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-12-0x0000000000080000-0x000000000010B000-memory.dmp

Filesize
556KB

Download
memory/2056-4-0x0000000000080000-0x000000000010B000-memory.dmp

Filesize
556KB

Download
memory/2292-0-0x00000000007A0000-0x0000000000828000-memory.dmp

Filesize
544KB

Download
memory/2292-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download