raccoon | 08923e38e5a073198b5423664fbca46575b89db9ec59376903b5e890746e3777

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 09:28

Target

d0853947bf27084121d2e2f4cd1c8223.exe
Size

429KB
MD5

d0853947bf27084121d2e2f4cd1c8223
SHA1

51cd9cccc388ba9eda901d40c82db37429eff71a
SHA256

08923e38e5a073198b5423664fbca46575b89db9ec59376903b5e890746e3777
SHA512

e5a05b1842b6cc03338141771fd922085033c3a60ebf92d6b25f09081c73121a32c9ee2aa27bd2037eb9cc51cd555850dd08e85ac8d75aa153b46f5d73428542
SSDEEP

6144:yrwdnt9vhzZ+TACmF8kb4UtUVLl84VQvaG6jcyed7jtXaYTU6BInvl9K:yrw/Y8ztC/dVjleFjBaYTj+

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/4244-2-0x0000000002FD0000-0x000000000305F000-memory.dmp	family_raccoon_v1
behavioral2/memory/4244-3-0x0000000000400000-0x0000000002CFA000-memory.dmp	family_raccoon_v1
behavioral2/memory/4244-4-0x0000000000400000-0x0000000002CFA000-memory.dmp	family_raccoon_v1
behavioral2/memory/4244-7-0x0000000002FD0000-0x000000000305F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1952	4244	WerFault.exe	82
3104	4244	WerFault.exe	82
4000	4244	WerFault.exe	82
3732	4244	WerFault.exe	82
3448	4244	WerFault.exe	82
1780	4244	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\d0853947bf27084121d2e2f4cd1c8223.exe
"C:\Users\Admin\AppData\Local\Temp\d0853947bf27084121d2e2f4cd1c8223.exe"
1⤵
PID:4244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 740
  2⤵
  - Program crash
  PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 748
  2⤵
  - Program crash
  PID:3104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 776
  2⤵
  - Program crash
  PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 924
  2⤵
  - Program crash
  PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 948
  2⤵
  - Program crash
  PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1088
  2⤵
  - Program crash
  PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4244 -ip 4244
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4244 -ip 4244
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4244 -ip 4244
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4244 -ip 4244
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4244 -ip 4244
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4244 -ip 4244
1⤵
PID:2460

memory/4244-1-0x0000000003080000-0x0000000003180000-memory.dmp

Filesize
1024KB

Download
memory/4244-2-0x0000000002FD0000-0x000000000305F000-memory.dmp

Filesize
572KB

Download
memory/4244-3-0x0000000000400000-0x0000000002CFA000-memory.dmp

Filesize
41.0MB

Download
memory/4244-4-0x0000000000400000-0x0000000002CFA000-memory.dmp

Filesize
41.0MB

Download
memory/4244-6-0x0000000003080000-0x0000000003180000-memory.dmp

Filesize
1024KB

Download
memory/4244-7-0x0000000002FD0000-0x000000000305F000-memory.dmp

Filesize
572KB

Download