Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 17:37
Static task
static1
Behavioral task
behavioral1
Sample
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe
-
Size
563KB
-
MD5
0fe3318a4215c96c7f28aec7623246f9
-
SHA1
cca3bc1b0ab60e208279faa32f4ff5d529c2d55c
-
SHA256
704ea934e75448ed30e38117fe27b81b6dfdeb0f2a498bd0ae5474ec3d5014d7
-
SHA512
7559153d08ceba65b8eb400030a486ae70a04810b4b6d7cd0348360053b50a659cf18ba56a51f2ca4bbe4b7f6c089acef966b77b9930a8077a4a978c8b92c981
-
SSDEEP
12288:0eMfrIjgs8VSVr/3Cq1iKFAtLW9emHBLXx8Z8XX5:09Ijgiv8C9vhLXx8qX5
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3744-2-0x0000000000AB0000-0x0000000000B3F000-memory.dmp family_raccoon_v1 behavioral2/memory/3744-3-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/3744-5-0x0000000000AB0000-0x0000000000B3F000-memory.dmp family_raccoon_v1 behavioral2/memory/3744-7-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/3744-6-0x0000000000400000-0x0000000000943000-memory.dmp family_raccoon_v1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0fe3318a4215c96c7f28aec7623246f9_JaffaCakes118.exe