Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 21:39
General
-
Target
JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe
-
Size
726.6MB
-
MD5
27909cdf575b73bba157c6437aaf6417
-
SHA1
b23e406b4fb65fa94a224188cc1e22b8f6866537
-
SHA256
639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c
-
SHA512
00408e9a59517e9d9a16d02a863f5863c545cd8c9934b37e01b7abeaef92bc07c5d0a1a5dde014276f4458344370ec06bb53d3ac4b5e1b52dffb9b21af2e12df
-
SSDEEP
98304:BYOuLHptGRgfl/J6fNx69CvCmdZHcW4wU0HTFPhXvCD564nJu6Gh/ZGX/U:twJtGRs/J6fNx6AJmCHdKnJu6w/b
Malware Config
Extracted
raccoon
0dcbeb99ec1adc5c2b2b94dc1e3fd2c4
http://94.131.106.116/
-
user_agent
TakeMyPainBack
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
3.5MB
-
Filesize
10.2MB