raccoon | 39804d887b31f48334e49bb8c285556c06bca9c9a9dfaec5d9f8fee609648bc6

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 10:46

Target

cb3536589b0f939cc1a4d5b14d6747eb.exe
Size

468KB
MD5

cb3536589b0f939cc1a4d5b14d6747eb
SHA1

baae44b86c6c16f9f70eb84ccba209f254b5c752
SHA256

39804d887b31f48334e49bb8c285556c06bca9c9a9dfaec5d9f8fee609648bc6
SHA512

6794422d7bba412aba230bfbddbadd8b042071b507737fdc90958923c8aa833111252877901c046dcbc3034ec6c00a7ff64e44ce9a7964267a99f45e73a884ca
SSDEEP

12288:aW8y4oW/dZJB9DjgH6czTPuWuWyfu0VjcWTH5ONVi:J4owxRgaURjsBjcbi

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/4176-2-0x0000000004A80000-0x0000000004B0F000-memory.dmp	family_raccoon_v1
behavioral2/memory/4176-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/4176-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/4176-5-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/4176-8-0x0000000004A80000-0x0000000004B0F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1320	4176	WerFault.exe	94
228	4176	WerFault.exe	94
1280	4176	WerFault.exe	94
3624	4176	WerFault.exe	94
4820	4176	WerFault.exe	94
4124	4176	WerFault.exe	94

C:\Users\Admin\AppData\Local\Temp\cb3536589b0f939cc1a4d5b14d6747eb.exe
"C:\Users\Admin\AppData\Local\Temp\cb3536589b0f939cc1a4d5b14d6747eb.exe"
1⤵
PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 740
  2⤵
  - Program crash
  PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 748
  2⤵
  - Program crash
  PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 780
  2⤵
  - Program crash
  PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 736
  2⤵
  - Program crash
  PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 940
  2⤵
  - Program crash
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1156
  2⤵
  - Program crash
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4176 -ip 4176
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4176 -ip 4176
1⤵
PID:340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4176 -ip 4176
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4176 -ip 4176
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4176 -ip 4176
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4176 -ip 4176
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2040

memory/4176-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/4176-2-0x0000000004A80000-0x0000000004B0F000-memory.dmp

Filesize
572KB

Download
memory/4176-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/4176-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/4176-5-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/4176-7-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/4176-8-0x0000000004A80000-0x0000000004B0F000-memory.dmp

Filesize
572KB

Download