raccoon | a4f16c8974fe2e604f71fa76c1266ed9e943c28c6a680892339cb497dbf5c521

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 14:19

Target

d3b9235c25f42947b78719590c688201.exe
Size

466KB
MD5

d3b9235c25f42947b78719590c688201
SHA1

b35fc97d14d5f5f41418b6a5bcf9a4c88a45f8f2
SHA256

a4f16c8974fe2e604f71fa76c1266ed9e943c28c6a680892339cb497dbf5c521
SHA512

49a0e51c3e76e627e5713c66ebeacec6a7466dc04a6c9280423d8f388cda93762bcbbf7df6a3d9c18dbf13420dd0dceaf26b3800b368cebda7a62af945118b75
SSDEEP

12288:Z1Rp5PfcYmmKWVY4Rh4OMwnaGw+nd7uyVO9vi:Vp5PfcR0RBlaGFnzQvi

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/2312-2-0x0000000004930000-0x00000000049C3000-memory.dmp	family_raccoon_v1
behavioral2/memory/2312-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/2312-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/2312-7-0x0000000004930000-0x00000000049C3000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3908	2312	WerFault.exe	84
3248	2312	WerFault.exe	84
1936	2312	WerFault.exe	84
4324	2312	WerFault.exe	84
3528	2312	WerFault.exe	84
832	2312	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\d3b9235c25f42947b78719590c688201.exe
"C:\Users\Admin\AppData\Local\Temp\d3b9235c25f42947b78719590c688201.exe"
1⤵
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 740
  2⤵
  - Program crash
  PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 776
  2⤵
  - Program crash
  PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 756
  2⤵
  - Program crash
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 876
  2⤵
  - Program crash
  PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1056
  2⤵
  - Program crash
  PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1168
  2⤵
  - Program crash
  PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2312 -ip 2312
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2312 -ip 2312
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2312 -ip 2312
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2312 -ip 2312
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2312 -ip 2312
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2312 -ip 2312
1⤵
PID:3016

memory/2312-1-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Filesize
1024KB

Download
memory/2312-2-0x0000000004930000-0x00000000049C3000-memory.dmp

Filesize
588KB

Download
memory/2312-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/2312-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/2312-6-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Filesize
1024KB

Download
memory/2312-7-0x0000000004930000-0x00000000049C3000-memory.dmp

Filesize
588KB

Download