raccoon | efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8

Resubmissions

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Size

2.0MB
MD5

6e230b9cff0edf73241c6937260ce5f1
SHA1

24575f7c562b2e6d9c14919a1feb3cce2c4328f8
SHA256

efca489e47185ce7ca7dfe88efaccf98ff4704430da1436f296f005e11a628d8
SHA512

0eb73a779f207cf3f78244b6014e5febc4ed06652cf45eaaea6798e26fa057eb5dd4799833a7e244d08d717d6a591ca5f84b999004820a0735f5c528baa087c0
SSDEEP

24576:ku6Jx3O0c+JY5UZ+XC0kGso/WaaaiPOBSBYEXz88Om8Lz9jb+pWZI0oYZQuEWYvH:eI0c++OCvkGsUWay0LYvH

Score

10^/10

raccoon dc276e119d9a4d74f954a04ada4178a488e1daac stealer

Malware Config

Extracted

Family

raccoon

Botnet

dc276e119d9a4d74f954a04ada4178a488e1daac

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=19hM-KLCQYseROyH-iWgBUyp7N46KgncH

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1376-3-0x0000000000810000-0x000000000089B000-memory.dmp	family_raccoon_v1
behavioral2/memory/1376-8-0x0000000000810000-0x000000000089B000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
7 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

description pid process target process

PID 2352 set thread context of 1376 2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4064 1376 WerFault.exe 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid process

2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid process

2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352 6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

flow	ioc
6	drive.google.com
7	drive.google.com

description	pid	process	target process
PID 2352 set thread context of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	pid_target	process	target process
4064	1376	WerFault.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	process
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

pid	process
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

description	pid	process	target process
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
PID 2352 wrote to memory of 1376	2352	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe	6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e230b9cff0edf73241c6937260ce5f1_JaffaCakes118.exe"
2⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1168
3⤵
- Program crash
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1376 -ip 1376
1⤵
PID:2960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-3-0x0000000000810000-0x000000000089B000-memory.dmp

Filesize
556KB

Download
memory/1376-8-0x0000000000810000-0x000000000089B000-memory.dmp

Filesize
556KB

Download
memory/2352-0-0x0000000003F00000-0x0000000003F88000-memory.dmp

Filesize
544KB

Download
memory/2352-1-0x0000000001710000-0x0000000001711000-memory.dmp

Filesize
4KB

Download