raccoon | 769bc8f704644f761d744fc69aa74068cc6ce9deb00858532e9c0d3910f1cc18

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_3d8bd4866f4b79d54edf519329b1e793_elex_manuscrypt_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample260601-p8zedsc16v
SHA256 769bc8f704644f761d744fc69aa74068cc6ce9deb00858532e9c0d3910f1cc18
MD5 3d8bd4866f4b79d54edf519329b1e793
SHA1 f448dd77fbc44cd77ea7cfa94ae9c6bb1e15c825
SHA512 2d4433f2e5fe5caa69b509640b3af983dd8ba3f945dd4b3a6d2dbecbe6b909750837ec0a58fdc41c37ec2f9847b82c6f37a6cb32d5aea3c5d3c73697f91d6f12
SSDEEP 6144:tnHHxowTIh3c37fzZDuONMO/aU3cX0/iOO/NXV5liNwUiSCQT7VFvZEls0BY:dHqw8hYfFDZCO/n80/iOeXbU6mR
TLSH
T10B5502263591D432C4A379326820CA919F3AB9710FB595C77BD50FAE9FE02C18F35786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery raccoon stealer

Malware Config

Signatures

Family: Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral2/memory/3680-2-0x0000000005310000-0x00000000053A2000-memory.dmp	family_raccoon_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4568	3680	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_3d8bd4866f4b79d54edf519329b1e793_elex_manuscrypt_redline-stealer_rhadamanthys_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_3d8bd4866f4b79d54edf519329b1e793_elex_manuscrypt_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3d8bd4866f4b79d54edf519329b1e793_elex_manuscrypt_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 268
  2⤵
  - Program crash
  PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3680 -ip 3680
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3680-1-0x0000000004F90000-0x0000000005090000-memory.dmp

Download

memory/3680-2-0x0000000005310000-0x00000000053A2000-memory.dmp