Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 09:40
Static task
static1
Behavioral task
behavioral1
Sample
69e8317021725fced39731100383692a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69e8317021725fced39731100383692a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
69e8317021725fced39731100383692a_JaffaCakes118.exe
-
Size
522KB
-
MD5
69e8317021725fced39731100383692a
-
SHA1
5816a1df18bfc97880095db7d3b9737ceb4ea2fd
-
SHA256
29cc6f28e6765cbeac318d98d1c7cde469031fc0f6f6b65e75e9f24c6ed64885
-
SHA512
a7cb1d6f7b11915d4be29663d29a1b267714a9e48acfd42d345ebce3d676821a1cb7c1a7e589de95ab8140a51c4bb83089c67a2a7f695307d7c23d5883de43ca
-
SSDEEP
12288:9c3MMZ1nyGJVe5ZtmZ1b7gGlMJzjiZ8WUik6y3tCIA:9gTy95a38GlijiyW9EtCIA
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral1/memory/2628-2-0x0000000000280000-0x000000000030F000-memory.dmp family_raccoon_v1 behavioral1/memory/2628-3-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral1/memory/2628-5-0x0000000000280000-0x000000000030F000-memory.dmp family_raccoon_v1 behavioral1/memory/2628-7-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral1/memory/2628-6-0x0000000000400000-0x0000000002B8D000-memory.dmp family_raccoon_v1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69e8317021725fced39731100383692a_JaffaCakes118.exe