raccoon | b116e410c3782d02bead5040dd0db95c651b25508eab6d745c589dd9d4d03f6c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 14:54

Target

e53117cf3022a3468ace9a641555f893_JaffaCakes118.exe
Size

487KB
MD5

e53117cf3022a3468ace9a641555f893
SHA1

e7691c460d3f1f1e0166cdbe96d6915b8589b3ec
SHA256

b116e410c3782d02bead5040dd0db95c651b25508eab6d745c589dd9d4d03f6c
SHA512

4fbd9fe56873baf274d4d8c4a3d689f5314ef44ed1832ffe8a3faa9cb76650df3f953490156f56bf1b5ad8b5cd2d5996cc6757a3f2b8e690c3d358db821951dd
SSDEEP

6144:AxLctMybxnUq44W07YQRdTfcoT5AlG5pyGS5XlW9DewsDr1cUvAhmLZrLgFVg8F2:AxItMyVUq4K7YQcoT5AlG6g1sX8mtc4

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/4828-2-0x0000000003B10000-0x0000000003B9F000-memory.dmp	family_raccoon_v1
behavioral2/memory/4828-3-0x0000000000400000-0x0000000001DC7000-memory.dmp	family_raccoon_v1
behavioral2/memory/4828-4-0x0000000000400000-0x0000000001DC7000-memory.dmp	family_raccoon_v1
behavioral2/memory/4828-7-0x0000000003B10000-0x0000000003B9F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1340	4828	WerFault.exe	84
3776	4828	WerFault.exe	84
3644	4828	WerFault.exe	84
880	4828	WerFault.exe	84
4352	4828	WerFault.exe	84
1872	4828	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\e53117cf3022a3468ace9a641555f893_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e53117cf3022a3468ace9a641555f893_JaffaCakes118.exe"
1⤵
PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 740
  2⤵
  - Program crash
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 776
  2⤵
  - Program crash
  PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 896
  2⤵
  - Program crash
  PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 776
  2⤵
  - Program crash
  PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1116
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1236
  2⤵
  - Program crash
  PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 4828
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4828 -ip 4828
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4828 -ip 4828
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4828 -ip 4828
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4828 -ip 4828
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4828 -ip 4828
1⤵
PID:4472

memory/4828-1-0x0000000001F40000-0x0000000002040000-memory.dmp

Filesize
1024KB

Download
memory/4828-2-0x0000000003B10000-0x0000000003B9F000-memory.dmp

Filesize
572KB

Download
memory/4828-3-0x0000000000400000-0x0000000001DC7000-memory.dmp

Filesize
25.8MB

Download
memory/4828-4-0x0000000000400000-0x0000000001DC7000-memory.dmp

Filesize
25.8MB

Download
memory/4828-5-0x0000000001F40000-0x0000000002040000-memory.dmp

Filesize
1024KB

Download
memory/4828-7-0x0000000003B10000-0x0000000003B9F000-memory.dmp

Filesize
572KB

Download