Analysis
-
max time kernel
92s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 21:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe
-
Size
726.6MB
-
MD5
27909cdf575b73bba157c6437aaf6417
-
SHA1
b23e406b4fb65fa94a224188cc1e22b8f6866537
-
SHA256
639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c
-
SHA512
00408e9a59517e9d9a16d02a863f5863c545cd8c9934b37e01b7abeaef92bc07c5d0a1a5dde014276f4458344370ec06bb53d3ac4b5e1b52dffb9b21af2e12df
-
SSDEEP
98304:BYOuLHptGRgfl/J6fNx69CvCmdZHcW4wU0HTFPhXvCD564nJu6Gh/ZGX/U:twJtGRs/J6fNx6AJmCHdKnJu6w/b
Malware Config
Extracted
raccoon
0dcbeb99ec1adc5c2b2b94dc1e3fd2c4
http://94.131.106.116/
-
user_agent
TakeMyPainBack
Signatures
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3216 JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe 3216 JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3216 JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe 3216 JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3216
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request64.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
94.131.106.116:80JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c.exe260 B 120 B 5 3
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
134.130.81.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
64.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
140 B 144 B 2 1
DNS Request
58.55.71.13.in-addr.arpa
DNS Request
58.55.71.13.in-addr.arpa
-
213 B 157 B 3 1
DNS Request
13.86.106.20.in-addr.arpa
DNS Request
13.86.106.20.in-addr.arpa
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
107.12.20.2.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa