Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 12:56

General

  • Target

    a20e837c00b73d104f168c5e3556ed69_JaffaCakes118.exe

  • Size

    506KB

  • MD5

    a20e837c00b73d104f168c5e3556ed69

  • SHA1

    f4d17997fded9c8fad153a67f02b0d768849bf1f

  • SHA256

    e1188d327931485523c83b1e16af6096af97f2753bfbc1a7065e42eb58a2b110

  • SHA512

    d5608c04297109df9abcfe8ad4f8b5b65f9a5349a6390b39a347378febdfbd97e644bc830fd9fe0944d2f4d2597e1d4251bf0b06a2b410c4ba21224328c0e0f3

  • SSDEEP

    6144:Hzbpw6dkcsjPtNxTvYcCRpykL8evCB4LffEQb9srZIC7SOPV+bW4vCIwY8:HzijVHYxL8WCWjPGrOCXV8DC5

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

ad90a7d46dd9833fb5a0293f0bb4aac37f7c0140

Attributes
  • url4cnc

    https://telete.in/open3entershift

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 5 IoCs
  • Raccoon family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a20e837c00b73d104f168c5e3556ed69_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a20e837c00b73d104f168c5e3556ed69_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2192-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

    Filesize

    1024KB

  • memory/2192-2-0x0000000004AD0000-0x0000000004B63000-memory.dmp

    Filesize

    588KB

  • memory/2192-3-0x0000000000400000-0x0000000000495000-memory.dmp

    Filesize

    596KB

  • memory/2192-4-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

    Filesize

    1024KB

  • memory/2192-6-0x0000000004AD0000-0x0000000004B63000-memory.dmp

    Filesize

    588KB

  • memory/2192-5-0x0000000000400000-0x0000000002CB5000-memory.dmp

    Filesize

    40.7MB

  • memory/2192-7-0x0000000000400000-0x0000000000495000-memory.dmp

    Filesize

    596KB