Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 23:03

General

  • Target

    ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe

  • Size

    462KB

  • MD5

    ed20a01ec2d93943bd0664fafb76daa6

  • SHA1

    4736f0170c32b4757e062eb6b1d47d46c7d5ab29

  • SHA256

    5bc02ebc009910c9625991d64f2170d0c1ddd2b403d34674e3b48e8fd0f22242

  • SHA512

    b22360f22bb48529b2b986f7ef37eb9d1cdb42eaaea7fa44b93fc48a0f2b02ee4d4029d1d0e80867ce0a8d8a322f9c463182910c83cc36d4b53fb2c50c470ccf

  • SSDEEP

    12288:+kRfdSeBVKuvlfIGLUzA9iP+ngOu4sl4OxCDi:PfnKu9fIGYzA4PyXOAi

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 5 IoCs
  • Raccoon family
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 740
      2⤵
      • Program crash
      PID:1956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 776
      2⤵
      • Program crash
      PID:2360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 756
      2⤵
      • Program crash
      PID:5000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 868
      2⤵
      • Program crash
      PID:1340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 1196
      2⤵
      • Program crash
      PID:1936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 700
      2⤵
      • Program crash
      PID:756
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 2900
    1⤵
      PID:4960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2900 -ip 2900
      1⤵
        PID:2100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 2900
        1⤵
          PID:2072
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2900 -ip 2900
          1⤵
            PID:384
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 2900
            1⤵
              PID:4932
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 2900
              1⤵
                PID:2304

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2900-1-0x0000000002F70000-0x0000000003070000-memory.dmp

                Filesize

                1024KB

              • memory/2900-2-0x0000000004910000-0x00000000049A1000-memory.dmp

                Filesize

                580KB

              • memory/2900-3-0x0000000000400000-0x0000000000492000-memory.dmp

                Filesize

                584KB

              • memory/2900-4-0x0000000002F70000-0x0000000003070000-memory.dmp

                Filesize

                1024KB

              • memory/2900-5-0x0000000004910000-0x00000000049A1000-memory.dmp

                Filesize

                580KB

              • memory/2900-7-0x0000000000400000-0x0000000000492000-memory.dmp

                Filesize

                584KB

              • memory/2900-6-0x0000000000400000-0x0000000002D01000-memory.dmp

                Filesize

                41.0MB