Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 07:28

General

  • Target

    JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe

  • Size

    512KB

  • MD5

    0aeb3be326df43129cfb31d10aea8c10

  • SHA1

    7442e98726a1d5d9133f3172588b16d793158e8e

  • SHA256

    fbe7eee5f2cc32b619fd3620ab5000a77786e59c29b2c635b4cc4b82e8c7c9b5

  • SHA512

    cbc53a813c3e1fc6849c7ce176cd3e7d78b6e2f52fa94ff1f7aa6457e220111ebddf96dcaa1a466bae4e0a2af3b7b31a1f6bd988ffb5acef1e4fefc07035136f

  • SSDEEP

    12288:KnAvbugs1YN5OuIg10tiFQO/WZScKAtgzHDd3xg0QiuB76sel:NvbDVIFYzWwAkh35o7

Malware Config

Extracted

Family

raccoon

Botnet

723d14b565e8f39294f31f86b0ce56cdaee75105

Attributes
  • url4cnc

    http://telegatt.top/jdiamond13

    http://telegka.top/jdiamond13

    http://telegin.top/jdiamond13

    https://t.me/jdiamond13

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 6 IoCs
  • Raccoon family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4992-1-0x00000000009C0000-0x0000000000AC0000-memory.dmp

    Filesize

    1024KB

  • memory/4992-2-0x0000000000920000-0x00000000009AE000-memory.dmp

    Filesize

    568KB

  • memory/4992-3-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4992-4-0x00000000009C0000-0x0000000000AC0000-memory.dmp

    Filesize

    1024KB

  • memory/4992-6-0x0000000000920000-0x00000000009AE000-memory.dmp

    Filesize

    568KB

  • memory/4992-5-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/4992-7-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4992-12-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB