raccoon | f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Size

1.2MB
MD5

794fd53672ca4d097d20087993d8c5ec
SHA1

6535b5046659ff169ba0f60d83416398b54be518
SHA256

f9395666396ddd990c6275b44d3b376fa49fdae187f4841275dc72271467f191
SHA512

88542d21075f88b9213d47c71263246351fd6a0b475ce9606975a7242eace88422beaafe6c7af97bf4e892c3703a55115753e54753ed739d58406304555b1ca5
SSDEEP

12288:bUtSe4izalBUu01gTL5vBFWJKRlQH8OrNeXg85hlrv+5RQLH5n8YfjgzEhal8Qpe:bUU3kM0OllQcOrggylgR4B0gsl/pN5Z

Score

10^/10

raccoon 1efa8bc342e6231de758bd380849cb5c0fe63cda stealer

Malware Config

Extracted

Family

raccoon

Botnet

1efa8bc342e6231de758bd380849cb5c0fe63cda

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1GHkkOFIb-WQAfra8RoDiA0vdpNIMBugL

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Raccoon Stealer V1 payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/1900-11-0x0000000000400000-0x0000000000477000-memory.dmp family_raccoon_v1
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

31 drive.google.com
32 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

description pid process target process

PID 3176 set thread context of 1900 3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2648 1900 WerFault.exe 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exeAUDIODG.EXE

description pid process

Token: SeIncBasePriorityPrivilege 3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Token: 33 4232 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4232 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

pid process

3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

pid process

3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176 794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/1900-11-0x0000000000400000-0x0000000000477000-memory.dmp	family_raccoon_v1

flow	ioc
31	drive.google.com
32	drive.google.com

description	pid	process	target process
PID 3176 set thread context of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

pid	pid_target	process	target process
2648	1900	WerFault.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
Token: 33	4232	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4232	AUDIODG.EXE

pid	process
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

pid	process
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

description	pid	process	target process
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
PID 3176 wrote to memory of 1900	3176	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe	794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176

C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\794fd53672ca4d097d20087993d8c5ec_JaffaCakes118.exe
2⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 1132
3⤵
- Program crash
PID:2648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1900 -ip 1900
1⤵
PID:3308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-11-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3176-1-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download
memory/3176-2-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-3-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-4-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-5-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-6-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-7-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-8-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3176-9-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3176-10-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download