Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2024 07:40

General

  • Target

    16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe

  • Size

    557KB

  • MD5

    16c5e3ca5e219a44a92927bacb6a36d1

  • SHA1

    4bad0e798f7e883721e894429ee46a33925f76c5

  • SHA256

    bdb12e8227f12fc06392f619e23e9bef8fef74dc637027bfad13b0e4ee02af8a

  • SHA512

    94da5d1f62443f75bd0fb25c397f7c70b004ed56d0d2cf025108ded95bbc906ad4fd96052ec99223874c8e861df7a97682b6b821b0b78b528e6744ec912ecc1a

  • SSDEEP

    12288:JeLBQBgFzcVyvFd/qHSaQzP5pL5/pYJtthTaan0x8L4O:J3BgF+H2pXYDtxn0x3O

Malware Config

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4040-1-0x0000000000C00000-0x0000000000D00000-memory.dmp

    Filesize

    1024KB

  • memory/4040-2-0x0000000000A20000-0x0000000000AAF000-memory.dmp

    Filesize

    572KB

  • memory/4040-3-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/4040-4-0x0000000000C00000-0x0000000000D00000-memory.dmp

    Filesize

    1024KB

  • memory/4040-5-0x0000000000A20000-0x0000000000AAF000-memory.dmp

    Filesize

    572KB

  • memory/4040-7-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/4040-6-0x0000000000400000-0x0000000000942000-memory.dmp

    Filesize

    5.3MB