Behavioral task
behavioral1
Sample
e834dd61f22ffdda9b1d9d6d6d7ce996_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e834dd61f22ffdda9b1d9d6d6d7ce996_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e834dd61f22ffdda9b1d9d6d6d7ce996_JaffaCakes118
-
Size
456KB
-
MD5
e834dd61f22ffdda9b1d9d6d6d7ce996
-
SHA1
23063e2db57e09ae6a8e89d2ba40dcc72a5b78d5
-
SHA256
dd4cc587093cae225df29efe43566c0b3f654aae6e1d5a86ba774340266ffe76
-
SHA512
51e5877582c39eef8c528d2011f648718645a1990312f2c680db0338777a77afdf764824eb7c9e81616213d1c2f2d73626088c3a9d5ecbeee240419a37bee3d1
-
SSDEEP
12288:q9Av0dpfJzrXPt6cPOC0huoOK70wwxh1ee:qAgpfpXpPsOnwwT
Malware Config
Extracted
raccoon
1ad7d0c9206e537f14587e7d441e75dba198e17b
-
url4cnc
http://185.235.131.214/gate/log.php
Signatures
-
Raccoon Stealer V1 payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon_v1 -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e834dd61f22ffdda9b1d9d6d6d7ce996_JaffaCakes118
Files
-
e834dd61f22ffdda9b1d9d6d6d7ce996_JaffaCakes118.exe windows:6 windows x86 arch:x86
5881621c5cff4b2b008196559d226375
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
GetLocaleInfoA
GetFileInformationByHandle
GetUserDefaultLCID
FileTimeToSystemTime
DeleteFileA
GetLocalTime
GetFileSize
GetTickCount
HeapFree
GetLastError
HeapAlloc
lstrcpynA
GetProcessHeap
lstrcmpiW
GetModuleFileNameA
Process32First
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
CreateMutexA
lstrcpyW
CreateToolhelp32Snapshot
MultiByteToWideChar
GetSystemWow64DirectoryW
OpenMutexA
Process32NextW
CreateFileA
GlobalAlloc
Process32Next
lstrcpyA
Process32FirstW
GlobalFree
GetSystemInfo
GlobalMemoryStatusEx
WideCharToMultiByte
CreateProcessA
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetTimeZoneInformation
OutputDebugStringW
LocalFree
LoadLibraryW
GetVersionExW
lstrlenW
GetPrivateProfileStringA
CreateDirectoryA
SystemTimeToFileTime
OpenProcess
CloseHandle
GetFileAttributesA
LocalFileTimeToFileTime
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrlenA
SetFilePointer
DeleteFileTransactedA
SetFileTime
WriteFile
GetPrivateProfileSectionNamesA
ReadFile
FindClose
FindNextFileA
CopyFileTransactedA
CreateDirectoryTransactedA
lstrcmpW
FreeLibrary
GetProcAddress
lstrcatW
LoadLibraryA
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
FindNextFileW
GetVersionExA
FindFirstFileW
GetACP
GetCommandLineW
GetCommandLineA
HeapReAlloc
SetEnvironmentVariableW
SetEnvironmentVariableA
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
LoadLibraryExW
RaiseException
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
FormatMessageW
GetStringTypeW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
user32
GetWindowDC
GetDesktopWindow
wsprintfW
wsprintfA
GetWindowRect
EnumDisplayDevicesA
GetSystemMetrics
gdi32
BitBlt
SaveDC
SelectObject
CreateDIBSection
CreateCompatibleDC
GetDeviceCaps
DeleteDC
RestoreDC
DeleteObject
advapi32
RegEnumKeyExW
RegQueryValueExA
CryptReleaseContext
GetUserNameA
CreateProcessWithTokenW
OpenProcessToken
ConvertSidToStringSidW
DuplicateTokenEx
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
CryptAcquireContextA
CredEnumerateW
CredFree
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
shell32
ShellExecuteA
SHGetFolderPathA
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
userenv
GetUserProfileDirectoryA
crypt32
CryptStringToBinaryA
CryptUnprotectData
ktmw32
RollbackTransaction
CommitTransaction
CreateTransaction
shlwapi
StrStrIW
StrCmpNW
wininet
InternetSetOptionA
HttpSendRequestA
InternetConnectA
InternetReadFile
HttpOpenRequestA
InternetOpenA
InternetCloseHandle
gdiplus
GdiplusShutdown
GdipGetImageEncoders
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipSaveImageToFile
GdipAlloc
GdipCloneImage
urlmon
URLDownloadToFileA
Sections
.text Size: 330KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ