raccoon | 24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7

Analysis

max time kernel
90s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 16:54

Target

24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll
Size

1.6MB
MD5

7c8f35ee73984b669e2eea85264a3aae
SHA1

0a847ff88aef14749d5c7d697da5d9264a383ef7
SHA256

24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7
SHA512

4f1636b7a0a0fb340ebbd2e42b42faa7c9ebc9a290c7fd93bf3adbac725201173d6f6543c1a36d28319ef272f88066534c109b28a34480d6ce6106e6ef2af8d1
SSDEEP

24576:A5Ki2AD4LrI6Q67uvtY9mvnPiXsr8ZGK+fxJzBraI5MGgQddfZ/4rS8+d:A5K9AMXI6H7uvtYYiGgigI5MoB/sSPd

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3396 4488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3396	4488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4272 wrote to memory of 4488	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 4488	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 4488	4272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll,#1
2⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 580
3⤵
- Program crash
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4488 -ip 4488
1⤵
PID:4540

memory/4488-132-0x0000000000000000-mapping.dmp

Download
memory/4488-133-0x0000000010000000-0x00000000101C3000-memory.dmp

Filesize
1.8MB

Download
memory/4488-134-0x0000000002010000-0x0000000002181000-memory.dmp

Filesize
1.4MB

Download
memory/4488-135-0x0000000000370000-0x0000000000374000-memory.dmp

Filesize
16KB

Download
memory/4488-136-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/4488-137-0x0000000002010000-0x0000000002181000-memory.dmp

Filesize
1.4MB

Download