raccoon | 924b9935b1f2be85aa36e0158f0a55c1200cdf9046077a5b491f1aeb034c2353

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 08:46

Target

e99afcbb149ba6dfbdd90c034b88fe73_JaffaCakes118.exe
Size

422KB
MD5

e99afcbb149ba6dfbdd90c034b88fe73
SHA1

be974111ad0a8f3870d09706ea07b5438f418798
SHA256

924b9935b1f2be85aa36e0158f0a55c1200cdf9046077a5b491f1aeb034c2353
SHA512

bf8b1f544ab9e689068f94b7ee5cfbe304b3756308d022be2e487216dd01aed0fcc2ac76e5d6b4c2f434a1125a88d5c71a2ecdafdb7bddd82447e77601c6b4a9
SSDEEP

6144:RyZ0UFc6AvAEvuGmqJgMTt7/xOk3WFa0Gh/AA02VC35RXb6uAU2dc56wge5JqtbB:day4EvuWd+kv02c35RrcdcIEUVKZc

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3324-2-0x00000000039D0000-0x0000000003A5F000-memory.dmp	family_raccoon_v1
behavioral2/memory/3324-3-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/3324-4-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/3324-7-0x00000000039D0000-0x0000000003A5F000-memory.dmp	family_raccoon_v1

Program crash 8 IoCs

pid	pid_target	Process	procid_target
1256	3324	WerFault.exe	83
5020	3324	WerFault.exe	83
4848	3324	WerFault.exe	83
2944	3324	WerFault.exe	83
1676	3324	WerFault.exe	83
2120	3324	WerFault.exe	83
376	3324	WerFault.exe	83
4680	3324	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\e99afcbb149ba6dfbdd90c034b88fe73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e99afcbb149ba6dfbdd90c034b88fe73_JaffaCakes118.exe"
1⤵
PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 740
  2⤵
  - Program crash
  PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 744
  2⤵
  - Program crash
  PID:5020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 740
  2⤵
  - Program crash
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 872
  2⤵
  - Program crash
  PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 936
  2⤵
  - Program crash
  PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1188
  2⤵
  - Program crash
  PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1232
  2⤵
  - Program crash
  PID:376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 748
  2⤵
  - Program crash
  PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3324 -ip 3324
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3324 -ip 3324
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3324 -ip 3324
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3324 -ip 3324
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3324 -ip 3324
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3324 -ip 3324
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3324 -ip 3324
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3324 -ip 3324
1⤵
PID:4864

memory/3324-1-0x0000000001DC0000-0x0000000001EC0000-memory.dmp

Filesize
1024KB

Download
memory/3324-2-0x00000000039D0000-0x0000000003A5F000-memory.dmp

Filesize
572KB

Download
memory/3324-3-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/3324-4-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/3324-6-0x0000000001DC0000-0x0000000001EC0000-memory.dmp

Filesize
1024KB

Download
memory/3324-7-0x00000000039D0000-0x0000000003A5F000-memory.dmp

Filesize
572KB

Download