Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-12-2024 05:48
General
-
Target
JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5.exe
-
Size
727.3MB
-
MD5
881cbc2da4c6467aec519f4909371af8
-
SHA1
ec9c0f602456802254ac2659cd0b42ef97d32b62
-
SHA256
dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5
-
SHA512
e1d3221d3663e09b8258a4b3ad77a201e18a7cc880b359edf1dd9a2123ed48c6b4888f27f7f9bad9b2da6328f5211fe709e94195e76288c9255997612415b098
-
SSDEEP
196608:M+saKEuW2K/olbQ1fYyKl//g8I62RZeD0DESWxb:MtEufKQlU1fYyyg8I62Ro0ZW
Malware Config
Extracted
raccoon
517bb0d640c1242c3f069aab3d1018d6
http://51.195.166.178/
-
user_agent
mozzzzzzzzzzz
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V2 payload 3 IoCs
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
4.0MB
-
Filesize
7.3MB