Analysis
-
max time kernel
91s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 22:18
General
-
Target
JaffaCakes118_8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c.exe
-
Size
726.3MB
-
MD5
404f92f8c6f0ddd6c75e0e6cda85b8a9
-
SHA1
05cf0d32101ad6c70ddd142cacfa112a1897a5a5
-
SHA256
8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c
-
SHA512
3da0419cc728cf5ce99b150c80f0415c52ea2bffee656f1dff82a8e02a30e716c9d67f350916389395aa1bacf1f7aa954b925ea7aeb1174b2702b9c986269b48
-
SSDEEP
98304:C+5Z98HF7E9ezcDo1GHxfHi4sN4Kufh6e4IRfrS0s4HWINqUlXp+zJQwzP4Lfr+u:xX8l4KOlZuu0e/A0s4HWe5iQU4F1++H
Malware Config
Extracted
raccoon
9d1e4355c2f2db3d7a690c4ac83e7372
http://77.73.133.1/
-
user_agent
mozzzzzzzzzzz
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
9.8MB
-
Filesize
3.5MB
-
Filesize
9.8MB