Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 17:37
Static task
static1
Behavioral task
behavioral1
Sample
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
-
Size
563KB
-
MD5
0fe3318a4215c96c7f28aec7623246f9
-
SHA1
cca3bc1b0ab60e208279faa32f4ff5d529c2d55c
-
SHA256
704ea934e75448ed30e38117fe27b81b6dfdeb0f2a498bd0ae5474ec3d5014d7
-
SHA512
7559153d08ceba65b8eb400030a486ae70a04810b4b6d7cd0348360053b50a659cf18ba56a51f2ca4bbe4b7f6c089acef966b77b9930a8077a4a978c8b92c981
-
SSDEEP
12288:0eMfrIjgs8VSVr/3Cq1iKFAtLW9emHBLXx8Z8XX5:09Ijgiv8C9vhLXx8qX5
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral1/memory/2032-2-0x00000000002E0000-0x000000000036F000-memory.dmp family_raccoon_v1 behavioral1/memory/2032-3-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral1/memory/2032-5-0x00000000002E0000-0x000000000036F000-memory.dmp family_raccoon_v1 behavioral1/memory/2032-7-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral1/memory/2032-6-0x0000000000400000-0x0000000000943000-memory.dmp family_raccoon_v1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe