Analysis
-
max time kernel
132s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 02:40
General
-
Target
JaffaCakes118_12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220.exe
-
Size
771.6MB
-
MD5
ce498d59fae27f5c42cda32c26d43520
-
SHA1
0eef9a1941d93e04cd6797ed6c79c6ca202f40dc
-
SHA256
12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220
-
SHA512
8c64f222d5322f3324b6658c9bee77c6233cce4c9120a4c1e30181e9c33fe0f6aec67d67d1c27dff6657a2bb6195d0a80bf6ca4cdc5cf054dca1be3ac65f6daa
-
SSDEEP
25165824:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnnnnnnnnnnnnnnn3nnnF:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnn1
Malware Config
Extracted
raccoon
d843e8fa1ee1dfc195b20362a6b5cd71
http://91.103.252.156:80/
-
user_agent
DuckTales
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 3 IoCs
-
Raccoon family
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
4KB
-
Filesize
9.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.7MB
-
Filesize
3.8MB