raccoon | 674822cd6f31947ba8042b6309927c9f34aed7450cd89e18d037ceffb5a911d5

General

Target

mixsix_20211025-105758.exe
Size

688KB
MD5

b5e4ae827306f85ad1c9c9a220591b10
SHA1

8e97b7071348aedc2325512e23a3a7bfaacc1c78
SHA256

674822cd6f31947ba8042b6309927c9f34aed7450cd89e18d037ceffb5a911d5
SHA512

4a4483cf5698bb900a037a6b7c3d7f9a0f7122eecaae3e99fdfbe312973fa64e19ef24338b4784152476920ce1aad00fd4c733cb38b10f2f85df95f0865f7756

Score

10^/10

raccoon 7c9b4504a63ed23664e38808e65948379b790395 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1640 created 2236 1640 WerFault.exe mixsix_20211025-105758.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211025-105758.exe

description pid process target process

PID 3524 set thread context of 2236 3524 mixsix_20211025-105758.exe mixsix_20211025-105758.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 2236 WerFault.exe mixsix_20211025-105758.exe

description	pid	process	target process
PID 1640 created 2236	1640	WerFault.exe	mixsix_20211025-105758.exe

description	pid	process	target process
PID 3524 set thread context of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe

pid	pid_target	process	target process
1640	2236	WerFault.exe	mixsix_20211025-105758.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1640 WerFault.exe
Token: SeBackupPrivilege 1640 WerFault.exe
Token: SeDebugPrivilege 1640 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1640	WerFault.exe
Token: SeBackupPrivilege	1640	WerFault.exe
Token: SeDebugPrivilege	1640	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

mixsix_20211025-105758.exe

description	pid	process	target process
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe
PID 3524 wrote to memory of 2236	3524	mixsix_20211025-105758.exe	mixsix_20211025-105758.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3524

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-105758.exe"
2⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 888
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-118-0x0000000000457320-mapping.dmp

Download
memory/2236-117-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/2236-119-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/2236-120-0x0000000002FF4000-0x0000000003043000-memory.dmp

Filesize
316KB

Download
memory/2236-121-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/2236-122-0x0000000002EE0000-0x000000000302A000-memory.dmp

Filesize
1.3MB

Download
memory/2236-123-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/3524-115-0x00000000013D1000-0x000000000143A000-memory.dmp

Filesize
420KB

Download
memory/3524-116-0x0000000001260000-0x00000000012F3000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing