raccoon | bacafa3bff1943a970f182754c7e09a3af4099afe9d416733a178e36acc068ed

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 01:10

Target

e3b8ef4954d8322511c94d2a63cae00e_JaffaCakes118.exe
Size

422KB
MD5

e3b8ef4954d8322511c94d2a63cae00e
SHA1

77c6dc512b53e9eded7567efa4ca53cfd3e1a88e
SHA256

bacafa3bff1943a970f182754c7e09a3af4099afe9d416733a178e36acc068ed
SHA512

c46b4d7d1fa17a6f3f8cb1b48eb5f831fe06489db634658e01d25192054faba81b2fd07bad5a6c70b0234d42878068970763cc5cfb9de833d8091134c7b5d2a8
SSDEEP

6144:xwcFPntd7cClH8hvQqxHs3Y/6vEPRqsDCNJ0n2qW3BHK9PEo0zqsI5/:xhFP7HYvVp4mFk3BEPEo8c

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 3 IoCs

resource	yara_rule
behavioral2/memory/1104-2-0x0000000003A10000-0x0000000003A9F000-memory.dmp	family_raccoon_v1
behavioral2/memory/1104-3-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/1104-6-0x0000000003A10000-0x0000000003A9F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2000	1104	WerFault.exe	85
3876	1104	WerFault.exe	85
1108	1104	WerFault.exe	85
4832	1104	WerFault.exe	85
2576	1104	WerFault.exe	85
1600	1104	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\e3b8ef4954d8322511c94d2a63cae00e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3b8ef4954d8322511c94d2a63cae00e_JaffaCakes118.exe"
1⤵
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 740
  2⤵
  - Program crash
  PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 776
  2⤵
  - Program crash
  PID:3876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 872
  2⤵
  - Program crash
  PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 892
  2⤵
  - Program crash
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1196
  2⤵
  - Program crash
  PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1236
  2⤵
  - Program crash
  PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1104 -ip 1104
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1104 -ip 1104
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1104 -ip 1104
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1104 -ip 1104
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1104 -ip 1104
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1104 -ip 1104
1⤵
PID:1604

memory/1104-1-0x0000000001E50000-0x0000000001F50000-memory.dmp

Filesize
1024KB

Download
memory/1104-2-0x0000000003A10000-0x0000000003A9F000-memory.dmp

Filesize
572KB

Download
memory/1104-3-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/1104-6-0x0000000003A10000-0x0000000003A9F000-memory.dmp

Filesize
572KB

Download
memory/1104-7-0x0000000001E50000-0x0000000001F50000-memory.dmp

Filesize
1024KB

Download