raccoon | da0985789b0077b3988e868e9fbf85f46b61451b4a4edc138c0ca419cf9acf68

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 10:23

Target

fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
Size

491KB
MD5

fc8a88de6146e2536acb8f2992997578
SHA1

ebf82ada9e836503009a96c0d5c4b404d38db46c
SHA256

da0985789b0077b3988e868e9fbf85f46b61451b4a4edc138c0ca419cf9acf68
SHA512

44f893bbdb7165ecde993749eb284d6c8f31b328caeddcb6e98131d307000337aa8a78fc9f2ab9377364a737723ec25cade788fd12314b39847aa142b6209be5
SSDEEP

6144:eLWt6H+3MM8r1EXnY89dv9Sfu+wUPz1nTrErMXncdwRsQ9DgxXgvCIutmuYZiDLU:eSYnr1EXYel9Fs338wzFg9IOwZih4

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3144-2-0x0000000003B50000-0x0000000003BDF000-memory.dmp	family_raccoon_v1
behavioral2/memory/3144-3-0x0000000000400000-0x0000000001DC8000-memory.dmp	family_raccoon_v1
behavioral2/memory/3144-4-0x0000000000400000-0x0000000001DC8000-memory.dmp	family_raccoon_v1
behavioral2/memory/3144-6-0x0000000003B50000-0x0000000003BDF000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3640	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
3232	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
748	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
2620	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
1452	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
3000	3144	WerFault.exe	fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8a88de6146e2536acb8f2992997578_JaffaCakes118.exe"
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 740
2⤵
- Program crash
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 776
2⤵
- Program crash
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 756
2⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 892
2⤵
- Program crash
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 1056
2⤵
- Program crash
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 1228
2⤵
- Program crash
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3144 -ip 3144
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3144 -ip 3144
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3144 -ip 3144
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3144 -ip 3144
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3144 -ip 3144
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3144 -ip 3144
1⤵
PID:2736

memory/3144-1-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download
memory/3144-2-0x0000000003B50000-0x0000000003BDF000-memory.dmp

Filesize
572KB

Download
memory/3144-3-0x0000000000400000-0x0000000001DC8000-memory.dmp

Filesize
25.8MB

Download
memory/3144-4-0x0000000000400000-0x0000000001DC8000-memory.dmp

Filesize
25.8MB

Download
memory/3144-6-0x0000000003B50000-0x0000000003BDF000-memory.dmp

Filesize
572KB

Download
memory/3144-7-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download