Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
-
Size
462KB
-
MD5
ed20a01ec2d93943bd0664fafb76daa6
-
SHA1
4736f0170c32b4757e062eb6b1d47d46c7d5ab29
-
SHA256
5bc02ebc009910c9625991d64f2170d0c1ddd2b403d34674e3b48e8fd0f22242
-
SHA512
b22360f22bb48529b2b986f7ef37eb9d1cdb42eaaea7fa44b93fc48a0f2b02ee4d4029d1d0e80867ce0a8d8a322f9c463182910c83cc36d4b53fb2c50c470ccf
-
SSDEEP
12288:+kRfdSeBVKuvlfIGLUzA9iP+ngOu4sl4OxCDi:PfnKu9fIGYzA4PyXOAi
Malware Config
Extracted
raccoon
1.7.3
cd8dc1031358b1aec55cc6bc447df1018b068607
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral2/memory/2900-2-0x0000000004910000-0x00000000049A1000-memory.dmp family_raccoon_v1 behavioral2/memory/2900-3-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/2900-5-0x0000000004910000-0x00000000049A1000-memory.dmp family_raccoon_v1 behavioral2/memory/2900-7-0x0000000000400000-0x0000000000492000-memory.dmp family_raccoon_v1 behavioral2/memory/2900-6-0x0000000000400000-0x0000000002D01000-memory.dmp family_raccoon_v1 -
Raccoon family
-
Program crash 6 IoCs
pid pid_target Process procid_target 1956 2900 WerFault.exe 82 2360 2900 WerFault.exe 82 5000 2900 WerFault.exe 82 1340 2900 WerFault.exe 82 1936 2900 WerFault.exe 82 756 2900 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7402⤵
- Program crash
PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7762⤵
- Program crash
PID:2360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7562⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 8682⤵
- Program crash
PID:1340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 11962⤵
- Program crash
PID:1936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7002⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 29001⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2900 -ip 29001⤵PID:2100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 29001⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 29001⤵PID:384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 29001⤵PID:4932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 29001⤵PID:2304