raccoon | 674822cd6f31947ba8042b6309927c9f34aed7450cd89e18d037ceffb5a911d5

Analysis

Target

mixsix_20211025-105758.exe
Size

688KB
MD5

b5e4ae827306f85ad1c9c9a220591b10
SHA1

8e97b7071348aedc2325512e23a3a7bfaacc1c78
SHA256

674822cd6f31947ba8042b6309927c9f34aed7450cd89e18d037ceffb5a911d5
SHA512

4a4483cf5698bb900a037a6b7c3d7f9a0f7122eecaae3e99fdfbe312973fa64e19ef24338b4784152476920ce1aad00fd4c733cb38b10f2f85df95f0865f7756

Score

10^/10

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211025-105758.exe

description pid process target process

PID 592 set thread context of 876 592 mixsix_20211025-105758.exe mixsix_20211025-105758.exe

description	pid	process	target process
PID 592 set thread context of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

mixsix_20211025-105758.exe

description	pid	process	target process
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 592 wrote to memory of 876	592	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe"
2⤵
PID:876

memory/592-54-0x00000000011A8000-0x0000000001211000-memory.dmp

Filesize
420KB

Download
memory/592-57-0x0000000000220000-0x00000000002B3000-memory.dmp

Filesize
588KB

Download
memory/876-55-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/876-56-0x0000000000457320-mapping.dmp

Download
memory/876-58-0x0000000002F88000-0x0000000002FD7000-memory.dmp

Filesize
316KB

Download
memory/876-59-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/876-60-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/876-61-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/876-63-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/876-62-0x0000000000270000-0x00000000002FE000-memory.dmp

Filesize
568KB

Download