Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 10:16
General
-
Target
JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe
-
Size
733.1MB
-
MD5
bd7147c5a9ac0f9a6b6076466f7d611f
-
SHA1
1baac5f76a99ab503630aeaafbebbe1addf997e8
-
SHA256
ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b
-
SHA512
0249f9a62b14ba5a7b0d3a32e0aa98bf7779fc31e9f968fa81cefaa8db8f1d62e6a87d813260746052d4ef00afd42191d2ddee501e97de793f2c099e0af50c04
-
SSDEEP
393216:QUWrN0Da9MZln8zmG9jy3Xly3naFgnXtxlWtI:QbrqGSZZ89jGXSaunXIS
Malware Config
Extracted
raccoon
fcfc256ec04f34118490eadaac61e88d
http://37.220.87.66/
-
user_agent
B1D3N_RIM_MY_ASS
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 4 IoCs
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.5MB
-
Filesize
23.5MB
-
Filesize
10.3MB
-
Filesize
23.5MB
-
Filesize
10.3MB
-
Filesize
23.5MB