Behavioral task
behavioral1
Sample
d3516b42cbf8ec0e32bb8eee99c8d4ff_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d3516b42cbf8ec0e32bb8eee99c8d4ff_JaffaCakes118
-
Size
540KB
-
MD5
d3516b42cbf8ec0e32bb8eee99c8d4ff
-
SHA1
225fa78451c46db2fb6ccc4e0e24d68e2cc40222
-
SHA256
466e30f40aaf378a0f65aeef035fdd10fd87f6fc432ddbeebef94913a0580a6c
-
SHA512
d4af508e2be35cc7f6413d5ce88470f9744beda50befe48dbd686f94e5d4eab737fe89fb4c8510239d3f147768a76105b3fe5fb71aebd0875d88fa6d35e2218b
-
SSDEEP
12288:gPviKuS4AZjzNGmydnkdXFxpgUpITyrUXKwWsKiSwDRq1g+:gPvWSXjzNNydnktppUazsKIRq13
Malware Config
Extracted
raccoon
af579f05f628552dbe148f730b58ef566293198c
-
url4cnc
https://drive.google.com/uc?export=download&id=1iNEp1vSw2ffa15BmPVxfNbK3IsHEHHis
Signatures
-
Raccoon Stealer V1 payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon_v1 -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d3516b42cbf8ec0e32bb8eee99c8d4ff_JaffaCakes118
Files
-
d3516b42cbf8ec0e32bb8eee99c8d4ff_JaffaCakes118.exe windows:6 windows x86 arch:x86
f00d3bb621b57bde0996d769e6548b43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileInformationByHandle
RemoveDirectoryTransactedA
GetUserDefaultLCID
FileTimeToSystemTime
DeleteFileA
GetLocalTime
GetTickCount
lstrlenA
GetLastError
HeapAlloc
lstrcpynA
lstrcmpiW
GetModuleFileNameA
GetCurrentProcess
GetEnvironmentVariableA
CreateMutexA
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
GetLocaleInfoA
OpenMutexA
Process32NextW
GetVersionExA
GlobalAlloc
lstrcpyA
Process32FirstW
GlobalFree
CreateDirectoryA
GetLogicalDriveStringsA
GlobalMemoryStatusEx
WideCharToMultiByte
CreateProcessA
GetComputerNameA
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetTimeZoneInformation
HeapReAlloc
GetModuleHandleA
UnmapViewOfFile
GetFileSize
lstrcpyW
LocalFree
LoadLibraryW
GetVersionExW
GetSystemWow64DirectoryW
lstrlenW
SystemTimeToFileTime
CloseHandle
CreateFileA
GetFileAttributesA
LocalFileTimeToFileTime
SetCurrentDirectoryA
GetCurrentDirectoryA
SetFilePointer
SetFileTime
WriteFile
ReadFile
FindClose
FindNextFileA
CopyFileTransactedA
CreateDirectoryTransactedA
FreeLibrary
GetProcessHeap
GetProcAddress
lstrcatW
LoadLibraryA
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
GetACP
GetCommandLineW
GetCommandLineA
DeleteFileTransactedA
GetSystemInfo
HeapFree
DeleteFileW
RemoveDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
LoadLibraryExW
RaiseException
RtlUnwind
TerminateProcess
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
CreateDirectoryW
CreateFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CopyFileW
FormatMessageW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
user32
GetDesktopWindow
wsprintfW
wsprintfA
GetSystemMetrics
EnumDisplayDevicesA
GetWindowRect
GetWindowDC
gdi32
BitBlt
SaveDC
SelectObject
CreateDIBSection
CreateCompatibleDC
GetDeviceCaps
DeleteDC
RestoreDC
DeleteObject
advapi32
GetTokenInformation
CryptGetHashParam
CryptDestroyHash
RegQueryValueExA
GetUserNameA
CreateProcessWithTokenW
OpenProcessToken
RegOpenKeyExA
ConvertSidToStringSidW
DuplicateTokenEx
RegQueryValueExW
CryptReleaseContext
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
CryptAcquireContextA
CredEnumerateW
CredFree
CryptCreateHash
CryptHashData
shell32
SHGetFolderPathA
ShellExecuteA
SHGetSpecialFolderPathW
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
userenv
GetUserProfileDirectoryA
ktmw32
RollbackTransaction
CreateTransaction
CommitTransaction
crypt32
CryptStringToBinaryA
CryptUnprotectData
shlwapi
StrStrIW
StrCmpNW
winhttp
WinHttpSendRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpOpen
WinHttpReadData
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
gdiplus
GdiplusStartup
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToFile
Sections
.text Size: 397KB - Virtual size: 396KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ