raccoon | 7fefd1d8f3c7c179599f65e7b125f93e15d274ef13ad9a37300a309b5847d327

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 07:52

Target

d054432e74a1747393b2d000262c8652.exe
Size

456KB
MD5

d054432e74a1747393b2d000262c8652
SHA1

a3f8951837dcac77da4cf404a715f846988cc9c0
SHA256

7fefd1d8f3c7c179599f65e7b125f93e15d274ef13ad9a37300a309b5847d327
SHA512

3c53427cb6545192b9232e50529efc60d811b8d37d7d770d661587f86d06ce33a369946f9cbee084146256aa496da73c42b56a3b79a11af2ee7fb9bea91d3bf3
SSDEEP

12288:6gnw5wGVfUUQ9K0iMKD71yxlFLzKuIGyoec:6gw5PUUSK0g4xbLzKjno

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3620-2-0x0000000004A50000-0x0000000004ADF000-memory.dmp	family_raccoon_v1
behavioral2/memory/3620-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/3620-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/3620-7-0x0000000004A50000-0x0000000004ADF000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1820	3620	WerFault.exe	93
3740	3620	WerFault.exe	93
4380	3620	WerFault.exe	93
3844	3620	WerFault.exe	93
3612	3620	WerFault.exe	93
4624	3620	WerFault.exe	93

C:\Users\Admin\AppData\Local\Temp\d054432e74a1747393b2d000262c8652.exe
"C:\Users\Admin\AppData\Local\Temp\d054432e74a1747393b2d000262c8652.exe"
1⤵
PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 740
  2⤵
  - Program crash
  PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 748
  2⤵
  - Program crash
  PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 852
  2⤵
  - Program crash
  PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 900
  2⤵
  - Program crash
  PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1100
  2⤵
  - Program crash
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 772
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3620 -ip 3620
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3620 -ip 3620
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3620 -ip 3620
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3620 -ip 3620
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3620 -ip 3620
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3620 -ip 3620
1⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

memory/3620-1-0x0000000002D10000-0x0000000002E10000-memory.dmp

Filesize
1024KB

Download
memory/3620-2-0x0000000004A50000-0x0000000004ADF000-memory.dmp

Filesize
572KB

Download
memory/3620-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/3620-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/3620-6-0x0000000002D10000-0x0000000002E10000-memory.dmp

Filesize
1024KB

Download
memory/3620-7-0x0000000004A50000-0x0000000004ADF000-memory.dmp

Filesize
572KB

Download