Overview

overview

10

Static

static

3

f280c0e47b...18.exe

windows7-x64

10

f280c0e47b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-04-2024 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f280c0e47b233bf506dca76aa052c9f4_JaffaCakes118.exe

  • Size

    495KB

  • MD5

    f280c0e47b233bf506dca76aa052c9f4

  • SHA1

    f3db1bf1d2c6fbfca8652264bb20b14e287eec26

  • SHA256

    18d0024251d5fab936f344a0d05785f40d3f18f2ea78fb8139f941b0d36a1f7b

  • SHA512

    648492a73b9c9206bb6a00b827cc740377175adae25faa3a21a2338c73f1ff8741c9fa556a3c913eb0bb2e459c147c98b2d25322b5d4da2e2b7931895b9c2f1f

  • SSDEEP

    12288:+H+fkXBj29w/9veM+U06RIQbGJANhLMMV3B/PATdKv:+CkX0Bwv+AQO3BwT

Score
10/10
raccoon8698be2e7e5a4e7e4dc8cd71c3845a10c60398c6stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

8698be2e7e5a4e7e4dc8cd71c3845a10c60398c6

Attributes
  • url4cnc

    https://telete.in/youyouhell0world

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f280c0e47b233bf506dca76aa052c9f4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f280c0e47b233bf506dca76aa052c9f4_JaffaCakes118.exe"
    1⤵
      PID:4156

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4156-1-0x0000000000610000-0x0000000000710000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/4156-2-0x00000000020D0000-0x0000000002163000-memory.dmp
      Filesize

      588KB

      Download
    • memory/4156-3-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/4156-4-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/4156-6-0x0000000000610000-0x0000000000710000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/4156-7-0x00000000020D0000-0x0000000002163000-memory.dmp
      Filesize

      588KB

      Download