raccoon | a5316932344a3c83e2e2bddb6cb19d73ce03fc820c20a573d5e7866071a84a5e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 12:58

Target

fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
Size

475KB
MD5

fa5832dd51887a1b02c0ec71fc4b69b4
SHA1

4465429197dae92d5bcf35148cbcd5087a360c03
SHA256

a5316932344a3c83e2e2bddb6cb19d73ce03fc820c20a573d5e7866071a84a5e
SHA512

aaf2e99bc0f3009c08a5f43b8d1a48da36d06d7c6b93e2d1c2974e7412f3b5d008cff71a66ff9ad37d54b30de5872d5362b965c60a42f483b0a0c457102b0b07
SSDEEP

6144:A4LNygs0VEb1n4nHPtoNQr/d8P96yqNHi1b57eAiQXaOr3pEY5zyi0aVKdx/O8b9:dBygDCb1naGTPtb1eXLY5zQdpOYztWi

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/100-2-0x0000000004AD0000-0x0000000004B61000-memory.dmp	family_raccoon_v1
behavioral2/memory/100-3-0x0000000000400000-0x0000000002D05000-memory.dmp	family_raccoon_v1
behavioral2/memory/100-4-0x0000000000400000-0x0000000002D05000-memory.dmp	family_raccoon_v1
behavioral2/memory/100-7-0x0000000004AD0000-0x0000000004B61000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4020	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
4776	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
3928	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
4404	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
4084	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
4044	100	WerFault.exe	fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa5832dd51887a1b02c0ec71fc4b69b4_JaffaCakes118.exe"
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 740
2⤵
- Program crash
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 776
2⤵
- Program crash
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 780
2⤵
- Program crash
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 884
2⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1196
2⤵
- Program crash
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 764
2⤵
- Program crash
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 100 -ip 100
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 100 -ip 100
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 100 -ip 100
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 100 -ip 100
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 100 -ip 100
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 100 -ip 100
1⤵
PID:2440

memory/100-1-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/100-2-0x0000000004AD0000-0x0000000004B61000-memory.dmp

Filesize
580KB

Download
memory/100-3-0x0000000000400000-0x0000000002D05000-memory.dmp

Filesize
41.0MB

Download
memory/100-4-0x0000000000400000-0x0000000002D05000-memory.dmp

Filesize
41.0MB

Download
memory/100-6-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/100-7-0x0000000004AD0000-0x0000000004B61000-memory.dmp

Filesize
580KB

Download