raccoon | 391cf04c2660bae380015998989bafc36b91d1a202d2579338c6d73da089e1d3

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 00:18

Target

efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
Size

456KB
MD5

efdb61309fcb462ccaba58e20bee576f
SHA1

d0dbc2e55c5dbe02210b73dd2f1917fcd3b0389e
SHA256

391cf04c2660bae380015998989bafc36b91d1a202d2579338c6d73da089e1d3
SHA512

cdf93d04f92655346cbec6ae5a0635801a0bbacb96ac613025c0dd90988d8896c62e00b2f326b92f86dc7d0e6abc876e60927b43223f44dddef24931b7d5025a
SSDEEP

12288:G1UMd4/W0L5ONE5yPlPKq3vqU5yf0p9YXn4ec:GSM2WYt5ygmvbIMrYXn4

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1396-2-0x0000000004A70000-0x0000000004AFF000-memory.dmp	family_raccoon_v1
behavioral2/memory/1396-3-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/1396-4-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral2/memory/1396-7-0x0000000004A70000-0x0000000004AFF000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3640	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
3876	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
4292	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
2400	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
2068	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
1604	1396	WerFault.exe	efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efdb61309fcb462ccaba58e20bee576f_JaffaCakes118.exe"
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 748
2⤵
- Program crash
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 784
2⤵
- Program crash
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 892
2⤵
- Program crash
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 908
2⤵
- Program crash
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1196
2⤵
- Program crash
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 712
2⤵
- Program crash
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1396 -ip 1396
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1396 -ip 1396
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1396 -ip 1396
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1396 -ip 1396
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1396 -ip 1396
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1396 -ip 1396
1⤵
PID:1260

memory/1396-1-0x0000000002FD0000-0x00000000030D0000-memory.dmp

Filesize
1024KB

Download
memory/1396-2-0x0000000004A70000-0x0000000004AFF000-memory.dmp

Filesize
572KB

Download
memory/1396-3-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/1396-4-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/1396-6-0x0000000002FD0000-0x00000000030D0000-memory.dmp

Filesize
1024KB

Download
memory/1396-7-0x0000000004A70000-0x0000000004AFF000-memory.dmp

Filesize
572KB

Download