raccoon | 6954e84e27926d02a392f13fc11ec75b0a4e726fee013098dada32a43a2270e4

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 03:11

Target

ad8a3e6b1ad102cf25b67e3843ec2f63.exe
Size

465KB
MD5

ad8a3e6b1ad102cf25b67e3843ec2f63
SHA1

d9c17b1e4348bd872042df2ae644317d044115cc
SHA256

6954e84e27926d02a392f13fc11ec75b0a4e726fee013098dada32a43a2270e4
SHA512

b08ea3a0d62cfb05fccf22d442ce1012317cc57d41998de1e145779a6a17ebcd71d9333c44d92055419e06e507af95a457d9086ed9a4b758ec60a4189dcba8d2
SSDEEP

6144:SLpkSd7zYQmNWllRIPYmcoj9Y1X1jyU8fZ1RpNH1bhKakk3C1IekOqr887Vr4IPC:S1RpD+PnGPjyFRZzbhoI4U8BOOqPi

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/1428-2-0x0000000004AE0000-0x0000000004B73000-memory.dmp	family_raccoon_v1
behavioral2/memory/1428-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/1428-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/1428-7-0x0000000004AE0000-0x0000000004B73000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4632	1428	WerFault.exe	92
4704	1428	WerFault.exe	92
2856	1428	WerFault.exe	92
3056	1428	WerFault.exe	92
3120	1428	WerFault.exe	92
3672	1428	WerFault.exe	92

C:\Users\Admin\AppData\Local\Temp\ad8a3e6b1ad102cf25b67e3843ec2f63.exe
"C:\Users\Admin\AppData\Local\Temp\ad8a3e6b1ad102cf25b67e3843ec2f63.exe"
1⤵
PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 740
  2⤵
  - Program crash
  PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 776
  2⤵
  - Program crash
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 752
  2⤵
  - Program crash
  PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 888
  2⤵
  - Program crash
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1096
  2⤵
  - Program crash
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1100
  2⤵
  - Program crash
  PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1428 -ip 1428
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1428 -ip 1428
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1428 -ip 1428
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1428 -ip 1428
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1428 -ip 1428
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:2240

memory/1428-1-0x0000000002FD0000-0x00000000030D0000-memory.dmp

Filesize
1024KB

Download
memory/1428-2-0x0000000004AE0000-0x0000000004B73000-memory.dmp

Filesize
588KB

Download
memory/1428-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/1428-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/1428-6-0x0000000002FD0000-0x00000000030D0000-memory.dmp

Filesize
1024KB

Download
memory/1428-7-0x0000000004AE0000-0x0000000004B73000-memory.dmp

Filesize
588KB

Download