raccoon | 8c459bab761b3e1e4fe969f7ee3bd9baa6738e649581ac24aba815f0e7f07401

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 16:34

Target

b52744b58341eccd5846d7f627bf5f65.exe
Size

456KB
MD5

b52744b58341eccd5846d7f627bf5f65
SHA1

479b5ec9c3c6fec2a0f73a2984bf273a3152db4d
SHA256

8c459bab761b3e1e4fe969f7ee3bd9baa6738e649581ac24aba815f0e7f07401
SHA512

8eb28de362bbd0b404b2dee019ad277eaf1ef447417ca2b21906b7f103878953eec2ccbae41a14ce9f20b0d9da06ff01d8e6e9d2fbbf534342d5156d16adfbb7
SSDEEP

12288:nbDMpAvZQyyd7T+SbZ3ZEODEhwHzB7ESgec:n4ASd7ySbA0ht7Jg

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3180-2-0x0000000002FD0000-0x000000000305F000-memory.dmp	family_raccoon_v1
behavioral2/memory/3180-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/3180-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/3180-7-0x0000000002FD0000-0x000000000305F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3732	3180	WerFault.exe	86
3756	3180	WerFault.exe	86
4432	3180	WerFault.exe	86
1580	3180	WerFault.exe	86
5040	3180	WerFault.exe	86
3168	3180	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\b52744b58341eccd5846d7f627bf5f65.exe
"C:\Users\Admin\AppData\Local\Temp\b52744b58341eccd5846d7f627bf5f65.exe"
1⤵
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 740
  2⤵
  - Program crash
  PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 776
  2⤵
  - Program crash
  PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 756
  2⤵
  - Program crash
  PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 892
  2⤵
  - Program crash
  PID:1580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1160
  2⤵
  - Program crash
  PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1228
  2⤵
  - Program crash
  PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3180 -ip 3180
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3180 -ip 3180
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3180 -ip 3180
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3180 -ip 3180
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3180 -ip 3180
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3180 -ip 3180
1⤵
PID:384

memory/3180-1-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/3180-2-0x0000000002FD0000-0x000000000305F000-memory.dmp

Filesize
572KB

Download
memory/3180-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/3180-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/3180-6-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/3180-7-0x0000000002FD0000-0x000000000305F000-memory.dmp

Filesize
572KB

Download