Overview

overview

10

Static

static

3

JaffaCakes...8f.exe

windows7-x64

10

JaffaCakes...8f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 20:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f.exe

  • Size

    726.6MB

  • MD5

    4a18eca46e5b202e614e5b0d69f6e9b3

  • SHA1

    c8459e1dfa0eaf9bc64500c850ddfa2a1c91fdff

  • SHA256

    070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f

  • SHA512

    f032a449a0014737901ed74cd25a65eaddbad6c49bb27146790263de8a2987cd26f99b5e2bff0d6994ebe092188d513a9719177ca0debf570eecd9d169ed6a2f

  • SSDEEP

    98304:RjRxgAbYvbDZhuIQRnm9hLeu6Snggd5erLaOB7At9Nd4WqVfqkezdQkjK/PTh:lRnbYvbDZh8RkLeOnGPalbsSAz3Th

Score
10/10
raccoon4d8caf3df626ca1a812c75113a24e797discoverystealer

Malware Config

Extracted

Family

raccoon

Botnet

4d8caf3df626ca1a812c75113a24e797

C2

http://45.153.243.16/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain
1
4d8caf3df626ca1a812c75113a24e797

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon family
    raccoon
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2364

Network

  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    self.events.data.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    self.events.data.microsoft.com
    IN A
    Response
    self.events.data.microsoft.com
    IN CNAME
    self-events-data.trafficmanager.net
    self-events-data.trafficmanager.net
    IN CNAME
    onedscolprdcus08.centralus.cloudapp.azure.com
    onedscolprdcus08.centralus.cloudapp.azure.com
    IN A
    104.208.16.88
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    85.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    85.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    88.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 45.153.243.16:80
    JaffaCakes118_070e276669c379bc0a2b8cf8bef518cd0a91a2b3dcf0e8ddb62339784581048f.exe
    260 B
     5
  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    149 B
     341 B
     2
    2

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    self.events.data.microsoft.com

    DNS Response

    104.208.16.88

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    85.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    85.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    88.16.208.104.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    88.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2364-0-0x0000000000412000-0x0000000000797000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/2364-1-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2364-3-0x0000000000400000-0x0000000000E3E000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/2364-2-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2364-5-0x0000000000400000-0x0000000000E3E000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/2364-6-0x0000000000412000-0x0000000000797000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/2364-7-0x0000000000400000-0x0000000000E3E000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/2364-8-0x0000000000412000-0x0000000000797000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/2364-9-0x0000000000400000-0x0000000000E3E000-memory.dmp

    Filesize

    10.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.