raccoon | d6f36585bba98da377675690c0d42956ae105e3b3a6e7210c0c27e46fe84f7e3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 12:08

Target

fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
Size

484KB
MD5

fa43acf24421ef19fdea1e85fa4d5030
SHA1

c7253c22f33a2f36f435a296d68e34aab08d4ed3
SHA256

d6f36585bba98da377675690c0d42956ae105e3b3a6e7210c0c27e46fe84f7e3
SHA512

175c3e6e22aea6bac93e4cc4cffe4880965161f00bce1eb13523e2a04a68abfb690f8ae9aaab826aabea96360e8d67503d946a5db2d4de9bc08dea79a4950178
SSDEEP

12288:z2Nlz0IQrPx411sib2Rsbtfq+vnlT72sbmYX/to6pzjr:Kdqx41Oib2RM1q+Z2sbH/jt

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2488-2-0x00000000022D0000-0x000000000235F000-memory.dmp	family_raccoon_v1
behavioral2/memory/2488-3-0x0000000000400000-0x0000000002196000-memory.dmp	family_raccoon_v1
behavioral2/memory/2488-4-0x0000000000400000-0x0000000002196000-memory.dmp	family_raccoon_v1
behavioral2/memory/2488-7-0x00000000022D0000-0x000000000235F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4960	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
2480	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
3292	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
768	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
4888	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
756	2488	WerFault.exe	fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa43acf24421ef19fdea1e85fa4d5030_JaffaCakes118.exe"
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 740
2⤵
- Program crash
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 776
2⤵
- Program crash
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 756
2⤵
- Program crash
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 892
2⤵
- Program crash
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1196
2⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1204
2⤵
- Program crash
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2488 -ip 2488
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2488 -ip 2488
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2488 -ip 2488
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2488 -ip 2488
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2488 -ip 2488
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2488 -ip 2488
1⤵
PID:4304

memory/2488-1-0x00000000021D0000-0x00000000022D0000-memory.dmp

Filesize
1024KB

Download
memory/2488-2-0x00000000022D0000-0x000000000235F000-memory.dmp

Filesize
572KB

Download
memory/2488-3-0x0000000000400000-0x0000000002196000-memory.dmp

Filesize
29.6MB

Download
memory/2488-4-0x0000000000400000-0x0000000002196000-memory.dmp

Filesize
29.6MB

Download
memory/2488-6-0x00000000021D0000-0x00000000022D0000-memory.dmp

Filesize
1024KB

Download
memory/2488-7-0x00000000022D0000-0x000000000235F000-memory.dmp

Filesize
572KB

Download