Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 10:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe
-
Size
733.1MB
-
MD5
bd7147c5a9ac0f9a6b6076466f7d611f
-
SHA1
1baac5f76a99ab503630aeaafbebbe1addf997e8
-
SHA256
ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b
-
SHA512
0249f9a62b14ba5a7b0d3a32e0aa98bf7779fc31e9f968fa81cefaa8db8f1d62e6a87d813260746052d4ef00afd42191d2ddee501e97de793f2c099e0af50c04
-
SSDEEP
393216:QUWrN0Da9MZln8zmG9jy3Xly3naFgnXtxlWtI:QbrqGSZZ89jGXSaunXIS
Malware Config
Extracted
raccoon
fcfc256ec04f34118490eadaac61e88d
http://37.220.87.66/
-
user_agent
B1D3N_RIM_MY_ASS
Signatures
-
Raccoon Stealer V2 payload 5 IoCs
resource yara_rule behavioral1/memory/2136-13-0x0000000000400000-0x0000000001B7A000-memory.dmp family_raccoon_v2 behavioral1/memory/2136-14-0x0000000000400000-0x0000000001B7A000-memory.dmp family_raccoon_v2 behavioral1/memory/2136-15-0x0000000000400000-0x0000000001B7A000-memory.dmp family_raccoon_v2 behavioral1/memory/2136-17-0x0000000000400000-0x0000000001B7A000-memory.dmp family_raccoon_v2 behavioral1/memory/2136-18-0x0000000000400000-0x0000000001B7A000-memory.dmp family_raccoon_v2 -
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2136 JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe 2136 JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2136 JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2136