raccoon | bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b

Resubmissions

02-06-2024 04:05

240602-enyl9aad6y 10

01-06-2024 20:23

240601-y6dvcaeg32 10

Analysis

max time kernel
82s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
Size

1.6MB
MD5

8bab62e8bc62a0040707e05735e96ce6
SHA1

b7381f5e7ffdb1a7d8d6d1a233b49132f5e2d6ae
SHA256

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b
SHA512

17b2631abcd284046ccc00b4ef7f1870c93fb6889381d6b653b78aa07a8bb93f9c2c5a41aed8b69d5d7c0cfc95c3f82d9202499988d24e69b0a2118fb430ac65
SSDEEP

24576:qG63yq7JWSM036kvcIb3eXP/AOfn2Fl5hvtwP6TD5:kW3NkkcK37fM59tHTD5

Score

10^/10

raccoon b92a235bffa69e2c5cbe1e5e08c8f58c785cae24 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b92a235bffa69e2c5cbe1e5e08c8f58c785cae24

Attributes

url4cnc
https://telete.in/jrubixred

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/488-15-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/488-17-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/488-18-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/488-19-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/488-21-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description pid process target process

PID 4028 set thread context of 488 4028 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4028 8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process	target process
PID 4028 set thread context of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

description	pid	process	target process
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
PID 4028 wrote to memory of 488	4028	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe	8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028

C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bab62e8bc62a0040707e05735e96ce6_JaffaCakes118.exe"
2⤵
PID:488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/488-21-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/488-19-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/488-18-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/488-17-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4028-5-0x0000000074380000-0x0000000074B31000-memory.dmp

Filesize
7.7MB

Download
memory/4028-12-0x0000000074380000-0x0000000074B31000-memory.dmp

Filesize
7.7MB

Download
memory/4028-7-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/4028-8-0x00000000054D0000-0x0000000005827000-memory.dmp

Filesize
3.3MB

Download
memory/4028-9-0x0000000006480000-0x00000000069AC000-memory.dmp

Filesize
5.2MB

Download
memory/4028-10-0x0000000006460000-0x0000000006468000-memory.dmp

Filesize
32KB

Download
memory/4028-11-0x000000007438E000-0x000000007438F000-memory.dmp

Filesize
4KB

Download
memory/4028-6-0x0000000005340000-0x00000000053DC000-memory.dmp

Filesize
624KB

Download
memory/4028-13-0x00000000079A0000-0x0000000007A58000-memory.dmp

Filesize
736KB

Download
memory/4028-14-0x0000000007AB0000-0x0000000007B48000-memory.dmp

Filesize
608KB

Download
memory/4028-0-0x000000007438E000-0x000000007438F000-memory.dmp

Filesize
4KB

Download
memory/4028-4-0x0000000074380000-0x0000000074B31000-memory.dmp

Filesize
7.7MB

Download
memory/4028-3-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/4028-2-0x0000000005850000-0x0000000005DF6000-memory.dmp

Filesize
5.6MB

Download
memory/4028-20-0x0000000074380000-0x0000000074B31000-memory.dmp

Filesize
7.7MB

Download
memory/4028-1-0x0000000000600000-0x0000000000748000-memory.dmp

Filesize
1.3MB

Download