Analysis
-
max time kernel
120s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 11:14
General
-
Target
JaffaCakes118_88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64.exe
-
Size
726.7MB
-
MD5
c5c73e442e6e2581a7b82620ca35000b
-
SHA1
904f581635c55c5be9735a27b024dac8d1e7dfa4
-
SHA256
88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64
-
SHA512
15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73
-
SSDEEP
196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI
Malware Config
Extracted
raccoon
4e27b39e9aaa6403f36702b4d66f5024
http://94.142.138.10/
http://94.142.138.9/
-
user_agent
23591
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 3 IoCs
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
3.8MB