raccoon | a1fff68c477fb80ab1506bfb8ce84533021cda6353d20bd0e524cc8ff5772376

Analysis

Target

mixsix_20211025-141659.exe
Size

578KB
MD5

2ad24cd92cd513a490e1b32957995f51
SHA1

e5a935dbb57c0f481c80d77769cbc37949daf6ce
SHA256

a1fff68c477fb80ab1506bfb8ce84533021cda6353d20bd0e524cc8ff5772376
SHA512

9b37de332a4c149e5f332f710038f5b78bcd6be6fba631867f250fb5d519d99e3e3b6d2bfd63f72ec763d045b37e59df1befa009adfe5d2c2979a85309d1e0d5

Score

10^/10

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211025-141659.exe

description pid process target process

PID 1620 set thread context of 564 1620 mixsix_20211025-141659.exe mixsix_20211025-141659.exe

description	pid	process	target process
PID 1620 set thread context of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

mixsix_20211025-141659.exe

description	pid	process	target process
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 1620 wrote to memory of 564	1620	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe"
2⤵
PID:564

memory/564-55-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/564-57-0x0000000000457320-mapping.dmp

Download
memory/564-58-0x0000000002EC8000-0x0000000002F17000-memory.dmp

Filesize
316KB

Download
memory/564-59-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/564-60-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/564-62-0x00000000002F0000-0x000000000037E000-memory.dmp

Filesize
568KB

Download
memory/564-61-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/564-63-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/1620-54-0x00000000007B8000-0x0000000000821000-memory.dmp

Filesize
420KB

Download
memory/1620-56-0x0000000000220000-0x00000000002B3000-memory.dmp

Filesize
588KB

Download