raccoon | a1fff68c477fb80ab1506bfb8ce84533021cda6353d20bd0e524cc8ff5772376

General

Target

mixsix_20211025-141659.exe
Size

578KB
MD5

2ad24cd92cd513a490e1b32957995f51
SHA1

e5a935dbb57c0f481c80d77769cbc37949daf6ce
SHA256

a1fff68c477fb80ab1506bfb8ce84533021cda6353d20bd0e524cc8ff5772376
SHA512

9b37de332a4c149e5f332f710038f5b78bcd6be6fba631867f250fb5d519d99e3e3b6d2bfd63f72ec763d045b37e59df1befa009adfe5d2c2979a85309d1e0d5

Score

10^/10

raccoon 7c9b4504a63ed23664e38808e65948379b790395 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2716 created 3520 2716 WerFault.exe mixsix_20211025-141659.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211025-141659.exe

description pid process target process

PID 3968 set thread context of 3520 3968 mixsix_20211025-141659.exe mixsix_20211025-141659.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2716 3520 WerFault.exe mixsix_20211025-141659.exe

description	pid	process	target process
PID 2716 created 3520	2716	WerFault.exe	mixsix_20211025-141659.exe

description	pid	process	target process
PID 3968 set thread context of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe

pid	pid_target	process	target process
2716	3520	WerFault.exe	mixsix_20211025-141659.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2716 WerFault.exe
Token: SeBackupPrivilege 2716 WerFault.exe
Token: SeDebugPrivilege 2716 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2716	WerFault.exe
Token: SeBackupPrivilege	2716	WerFault.exe
Token: SeDebugPrivilege	2716	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

mixsix_20211025-141659.exe

description	pid	process	target process
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe
PID 3968 wrote to memory of 3520	3968	mixsix_20211025-141659.exe	mixsix_20211025-141659.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211025-141659.exe"
2⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1208
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-118-0x0000000000457320-mapping.dmp

Download
memory/3520-117-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/3520-119-0x0000000003024000-0x0000000003073000-memory.dmp

Filesize
316KB

Download
memory/3520-120-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/3520-122-0x0000000002ED0000-0x000000000301A000-memory.dmp

Filesize
1.3MB

Download
memory/3520-121-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/3520-123-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/3968-116-0x00000000005D0000-0x000000000067E000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing