raccoon | bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b

Resubmissions

02-06-2024 04:05

240602-enyl9aad6y 10

01-06-2024 20:23

240601-y6dvcaeg32 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
Size

1.6MB
MD5

8bab62e8bc62a0040707e05735e96ce6
SHA1

b7381f5e7ffdb1a7d8d6d1a233b49132f5e2d6ae
SHA256

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b
SHA512

17b2631abcd284046ccc00b4ef7f1870c93fb6889381d6b653b78aa07a8bb93f9c2c5a41aed8b69d5d7c0cfc95c3f82d9202499988d24e69b0a2118fb430ac65
SSDEEP

24576:qG63yq7JWSM036kvcIb3eXP/AOfn2Fl5hvtwP6TD5:kW3NkkcK37fM59tHTD5

Score

10^/10

raccoon b92a235bffa69e2c5cbe1e5e08c8f58c785cae24 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b92a235bffa69e2c5cbe1e5e08c8f58c785cae24

Attributes

url4cnc
https://telete.in/jrubixred

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3568-16-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/3568-15-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/3568-18-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/3568-19-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description pid process target process

PID 1976 set thread context of 3568 1976 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1976 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process	target process
PID 1976 set thread context of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process	target process
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 1976 wrote to memory of 3568	1976	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe"
2⤵
PID:3568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-10-0x0000000006600000-0x0000000006608000-memory.dmp

Filesize
32KB

Download
memory/1976-13-0x0000000007BC0000-0x0000000007C78000-memory.dmp

Filesize
736KB

Download
memory/1976-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/1976-3-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/1976-5-0x0000000005930000-0x00000000059CC000-memory.dmp

Filesize
624KB

Download
memory/1976-4-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1976-6-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/1976-0-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/1976-20-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1976-8-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1976-7-0x0000000005AC0000-0x0000000005E14000-memory.dmp

Filesize
3.3MB

Download
memory/1976-11-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/1976-12-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1976-1-0x0000000000C90000-0x0000000000DD8000-memory.dmp

Filesize
1.3MB

Download
memory/1976-14-0x0000000007CC0000-0x0000000007D58000-memory.dmp

Filesize
608KB

Download
memory/1976-9-0x0000000006A20000-0x0000000006F4C000-memory.dmp

Filesize
5.2MB

Download
memory/3568-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3568-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3568-19-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3568-18-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download