raccoon | be6bfe3d73f5617378ac34a57799b98879e84ab04c890a20271c1d0102c22530

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 15:49

Target

f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
Size

429KB
MD5

f6213ed3dc89864356bd7615b6bb72d8
SHA1

8d98570aff71309702c0087942c4cc8cf2432aa0
SHA256

be6bfe3d73f5617378ac34a57799b98879e84ab04c890a20271c1d0102c22530
SHA512

55ff4cf649fe51356707df8c460669be3ddd8f30edb77682cbd6e0ecfac8d37ab42429058912a51c2b7e95bf74d913f98b586be70bdb824b19c313c2d0181e76
SSDEEP

6144:YPQ4tFY9KSB1NVIi2auQW2dx0aah/jP8GG3RPbVJENTxpxd6bIFH+d8UlD:YPQ4tFlSB1dd8x3aRJE1vCCH+R

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2508-2-0x0000000004940000-0x00000000049CF000-memory.dmp	family_raccoon_v1
behavioral2/memory/2508-3-0x0000000000400000-0x0000000002CFA000-memory.dmp	family_raccoon_v1
behavioral2/memory/2508-7-0x0000000004940000-0x00000000049CF000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2236	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
2076	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
3368	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
3488	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
4584	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
4232	2508	WerFault.exe	f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6213ed3dc89864356bd7615b6bb72d8_JaffaCakes118.exe"
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 740
2⤵
- Program crash
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 776
2⤵
- Program crash
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 756
2⤵
- Program crash
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 892
2⤵
- Program crash
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1200
2⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 856
2⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2508 -ip 2508
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2508 -ip 2508
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2508 -ip 2508
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2508 -ip 2508
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2508 -ip 2508
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2508 -ip 2508
1⤵
PID:1588

memory/2508-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/2508-2-0x0000000004940000-0x00000000049CF000-memory.dmp

Filesize
572KB

Download
memory/2508-3-0x0000000000400000-0x0000000002CFA000-memory.dmp

Filesize
41.0MB

Download
memory/2508-6-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/2508-7-0x0000000004940000-0x00000000049CF000-memory.dmp

Filesize
572KB

Download