Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 09:40

General

  • Target

    69e8317021725fced39731100383692a_JaffaCakes118.exe

  • Size

    522KB

  • MD5

    69e8317021725fced39731100383692a

  • SHA1

    5816a1df18bfc97880095db7d3b9737ceb4ea2fd

  • SHA256

    29cc6f28e6765cbeac318d98d1c7cde469031fc0f6f6b65e75e9f24c6ed64885

  • SHA512

    a7cb1d6f7b11915d4be29663d29a1b267714a9e48acfd42d345ebce3d676821a1cb7c1a7e589de95ab8140a51c4bb83089c67a2a7f695307d7c23d5883de43ca

  • SSDEEP

    12288:9c3MMZ1nyGJVe5ZtmZ1b7gGlMJzjiZ8WUik6y3tCIA:9gTy95a38GlijiyW9EtCIA

Malware Config

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\69e8317021725fced39731100383692a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69e8317021725fced39731100383692a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2628-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

    Filesize

    1024KB

  • memory/2628-2-0x0000000000280000-0x000000000030F000-memory.dmp

    Filesize

    572KB

  • memory/2628-3-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/2628-4-0x0000000002D50000-0x0000000002E50000-memory.dmp

    Filesize

    1024KB

  • memory/2628-5-0x0000000000280000-0x000000000030F000-memory.dmp

    Filesize

    572KB

  • memory/2628-7-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/2628-6-0x0000000000400000-0x0000000002B8D000-memory.dmp

    Filesize

    39.6MB