raccoon | 58a4a025ed89814733e8c04a72fe10f46fa06ee1a0b81a74436731e5baf0fb42

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 06:52

Target

c7f80490fb31359ad9b3e1845eac8d09.exe
Size

423KB
MD5

c7f80490fb31359ad9b3e1845eac8d09
SHA1

5097794c29dbd6a551a57ad86c9ce6b11ea0eba9
SHA256

58a4a025ed89814733e8c04a72fe10f46fa06ee1a0b81a74436731e5baf0fb42
SHA512

6468dde17cd7f83feb4b04ea33f0a5d9314b94a85832942e39c665eb399087894ad1a31812cd8ebb9e0620c03ea3ba768e62aa9f51ecccb495f19f6791d858d1
SSDEEP

6144:dn1yycr50lzUyEnA2qCQ1tmiPwjEONc5BdNNy7Y1he1OO03kaV/LCZfAsI5/:hKGCjqCTiPSEONcfbS1NQXV/LCZJc

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/1880-2-0x0000000002080000-0x000000000210F000-memory.dmp	family_raccoon_v1
behavioral2/memory/1880-3-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/1880-4-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/1880-7-0x0000000002080000-0x000000000210F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3480	1880	WerFault.exe	94
4208	1880	WerFault.exe	94
2432	1880	WerFault.exe	94
4620	1880	WerFault.exe	94
2376	1880	WerFault.exe	94
3804	1880	WerFault.exe	94

C:\Users\Admin\AppData\Local\Temp\c7f80490fb31359ad9b3e1845eac8d09.exe
"C:\Users\Admin\AppData\Local\Temp\c7f80490fb31359ad9b3e1845eac8d09.exe"
1⤵
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 740
  2⤵
  - Program crash
  PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 760
  2⤵
  - Program crash
  PID:4208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 892
  2⤵
  - Program crash
  PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 900
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 924
  2⤵
  - Program crash
  PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1168
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1880 -ip 1880
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1880 -ip 1880
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1880 -ip 1880
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1880 -ip 1880
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1880 -ip 1880
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1880 -ip 1880
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3664 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3696

memory/1880-1-0x0000000002110000-0x0000000002210000-memory.dmp

Filesize
1024KB

Download
memory/1880-2-0x0000000002080000-0x000000000210F000-memory.dmp

Filesize
572KB

Download
memory/1880-3-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/1880-4-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/1880-6-0x0000000002110000-0x0000000002210000-memory.dmp

Filesize
1024KB

Download
memory/1880-7-0x0000000002080000-0x000000000210F000-memory.dmp

Filesize
572KB

Download