Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe
-
Size
557KB
-
MD5
16c5e3ca5e219a44a92927bacb6a36d1
-
SHA1
4bad0e798f7e883721e894429ee46a33925f76c5
-
SHA256
bdb12e8227f12fc06392f619e23e9bef8fef74dc637027bfad13b0e4ee02af8a
-
SHA512
94da5d1f62443f75bd0fb25c397f7c70b004ed56d0d2cf025108ded95bbc906ad4fd96052ec99223874c8e861df7a97682b6b821b0b78b528e6744ec912ecc1a
-
SSDEEP
12288:JeLBQBgFzcVyvFd/qHSaQzP5pL5/pYJtthTaan0x8L4O:J3BgF+H2pXYDtxn0x3O
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral2/memory/4040-2-0x0000000000A20000-0x0000000000AAF000-memory.dmp family_raccoon_v1 behavioral2/memory/4040-3-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/4040-5-0x0000000000A20000-0x0000000000AAF000-memory.dmp family_raccoon_v1 behavioral2/memory/4040-7-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/4040-6-0x0000000000400000-0x0000000000942000-memory.dmp family_raccoon_v1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16c5e3ca5e219a44a92927bacb6a36d1_JaffaCakes118.exe