raccoon | fc88fe29755c931864c4f068bb439637f259220ba0f6d54de0d1298b790181f6

Resubmissions

11-04-2024 16:06

11-04-2024 15:30

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-uk
resource tags

arch:x64arch:x86image:win10v2004-20240226-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
11-04-2024 16:06

Target

edc060932eab71ee1990e79a30999b2f_JaffaCakes118.exe
Size

670KB
MD5

edc060932eab71ee1990e79a30999b2f
SHA1

8ad274131ff11f58e894bf238d866b822150e511
SHA256

fc88fe29755c931864c4f068bb439637f259220ba0f6d54de0d1298b790181f6
SHA512

a3be88ae1adcb79c6f257520cfc909ed632894783821bd5bb6cccc48773a267fba41550fcb954f493543e105aed152d73e8c7dbb43e0df6e84b7086a8a69c673
SSDEEP

12288:/X/i67DCzMebmibKTGrZ3Jg+oMGIsuIdoEaRx5Cc7cY5AypgR7lMxVd:/X/zn/yNJZ+9IsuaoEwx5Cc7cY5Aypgm

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

resource	yara_rule
behavioral2/memory/808-1-0x0000000004A30000-0x0000000004AC1000-memory.dmp	family_raccoon_v1
behavioral2/memory/808-2-0x0000000000400000-0x0000000004414000-memory.dmp	family_raccoon_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	808	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\edc060932eab71ee1990e79a30999b2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edc060932eab71ee1990e79a30999b2f_JaffaCakes118.exe"
1⤵
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 608
  2⤵
  - Program crash
  PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 808 -ip 808
1⤵
PID:628

memory/808-0-0x00000000049E0000-0x0000000004A2F000-memory.dmp

Filesize
316KB

Download
memory/808-1-0x0000000004A30000-0x0000000004AC1000-memory.dmp

Filesize
580KB

Download
memory/808-2-0x0000000000400000-0x0000000004414000-memory.dmp

Filesize
64.1MB

Download