raccoon | e7389511c617c606bacb9713d6ece1c19f796cf2bb8f260303841e486c57f05b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 08:42

Target

f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
Size

493KB
MD5

f7a683f3e5742422e1515437e2e81c2d
SHA1

965109b169374d68a69d469e857a0b7fb2f3be03
SHA256

e7389511c617c606bacb9713d6ece1c19f796cf2bb8f260303841e486c57f05b
SHA512

990d02e202d80366981c19c96a18bae64c8e93f4cddd219636f19ddabb39177a051b600c90284502e2ef51de3e619241d5792cbe5aef7c31489602915dfe9a20
SSDEEP

12288:bdOViYMZXmNvSGh0MrjXyzdu5B/mj9k9TDv1Hc9c:k/YcSGh3aJu5oBkpvZ

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1664-2-0x00000000039D0000-0x0000000003A5F000-memory.dmp	family_raccoon_v1
behavioral2/memory/1664-3-0x0000000000400000-0x0000000001DC8000-memory.dmp	family_raccoon_v1
behavioral2/memory/1664-4-0x0000000000400000-0x0000000001DC8000-memory.dmp	family_raccoon_v1
behavioral2/memory/1664-7-0x00000000039D0000-0x0000000003A5F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4248	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
4916	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
4520	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
4120	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
1520	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
2508	1664	WerFault.exe	f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7a683f3e5742422e1515437e2e81c2d_JaffaCakes118.exe"
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 744
2⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 776
2⤵
- Program crash
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 736
2⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 928
2⤵
- Program crash
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1196
2⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 632
2⤵
- Program crash
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1664 -ip 1664
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1664 -ip 1664
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1664 -ip 1664
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1664 -ip 1664
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1664 -ip 1664
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1664 -ip 1664
1⤵
PID:1292

memory/1664-1-0x0000000001E50000-0x0000000001F50000-memory.dmp

Filesize
1024KB

Download
memory/1664-2-0x00000000039D0000-0x0000000003A5F000-memory.dmp

Filesize
572KB

Download
memory/1664-3-0x0000000000400000-0x0000000001DC8000-memory.dmp

Filesize
25.8MB

Download
memory/1664-4-0x0000000000400000-0x0000000001DC8000-memory.dmp

Filesize
25.8MB

Download
memory/1664-6-0x0000000001E50000-0x0000000001F50000-memory.dmp

Filesize
1024KB

Download
memory/1664-7-0x00000000039D0000-0x0000000003A5F000-memory.dmp

Filesize
572KB

Download