raccoon | 23e9fb7e3274b454949f0673204740f18ff3624afd5fcd001d595b1f20d2c4d7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 18:07

Target

c94468ae6d79122b9e68727bddb7da09.exe
Size

522KB
MD5

c94468ae6d79122b9e68727bddb7da09
SHA1

c3f821f13fd765b0c93583e3d23e2e58a021e255
SHA256

23e9fb7e3274b454949f0673204740f18ff3624afd5fcd001d595b1f20d2c4d7
SHA512

adac3ff4a25bbd49032710f0f456b564e49d17e4ef1a6e3b5c0d5df868e784fc964de965cb14bc9f30749f322b3aad726f19c71e2e3e1e164e151b088018b200
SSDEEP

12288:zHYRgYg3KvgMMufjMonY8/VvxN7VebNJQIqbXDkjR54BW0f:rYWJ0tMufjMdsvxN7VmQtbmRG00

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/4572-2-0x0000000003E10000-0x0000000003E9F000-memory.dmp	family_raccoon_v1
behavioral2/memory/4572-3-0x0000000000400000-0x00000000021A0000-memory.dmp	family_raccoon_v1
behavioral2/memory/4572-4-0x0000000000400000-0x00000000021A0000-memory.dmp	family_raccoon_v1
behavioral2/memory/4572-7-0x0000000003E10000-0x0000000003E9F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4784	4572	WerFault.exe	87
4168	4572	WerFault.exe	87
1068	4572	WerFault.exe	87
4888	4572	WerFault.exe	87
1124	4572	WerFault.exe	87
2520	4572	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\c94468ae6d79122b9e68727bddb7da09.exe
"C:\Users\Admin\AppData\Local\Temp\c94468ae6d79122b9e68727bddb7da09.exe"
1⤵
PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 752
  2⤵
  - Program crash
  PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 776
  2⤵
  - Program crash
  PID:4168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 696
  2⤵
  - Program crash
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 888
  2⤵
  - Program crash
  PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1100
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 768
  2⤵
  - Program crash
  PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4572 -ip 4572
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4572 -ip 4572
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4572 -ip 4572
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4572 -ip 4572
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4572 -ip 4572
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4572 -ip 4572
1⤵
PID:3992

memory/4572-1-0x0000000002470000-0x0000000002570000-memory.dmp

Filesize
1024KB

Download
memory/4572-2-0x0000000003E10000-0x0000000003E9F000-memory.dmp

Filesize
572KB

Download
memory/4572-3-0x0000000000400000-0x00000000021A0000-memory.dmp

Filesize
29.6MB

Download
memory/4572-4-0x0000000000400000-0x00000000021A0000-memory.dmp

Filesize
29.6MB

Download
memory/4572-6-0x0000000002470000-0x0000000002570000-memory.dmp

Filesize
1024KB

Download
memory/4572-7-0x0000000003E10000-0x0000000003E9F000-memory.dmp

Filesize
572KB

Download