raccoon | ce446701e5909550dcea95e229a76de9dab64b8f1642daa4f92c11a8bcd10771

General

Target

mixsix_20211026-230331.exe
Size

649KB
MD5

0f2c6fea427d273ea705cb397229ea1c
SHA1

f8a7502b1773dcc92b62cae9fc52fbf2c48cddd0
SHA256

ce446701e5909550dcea95e229a76de9dab64b8f1642daa4f92c11a8bcd10771
SHA512

605d6ee544ac3dc103e7effc687494e49bfd831fbef9b1df77c9f5ce58e9f699991c5f83a9ab490593adbf15f0f1d38bb675b9e56b62863f3b1a310eb960a14c

Score

10^/10

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211026-230331.exe

description pid process target process

PID 2044 set thread context of 580 2044 mixsix_20211026-230331.exe mixsix_20211026-230331.exe

description	pid	process	target process
PID 2044 set thread context of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

mixsix_20211026-230331.exe

description	pid	process	target process
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 2044 wrote to memory of 580	2044	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"
2⤵
PID:580

memory/580-64-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/580-60-0x0000000000457320-mapping.dmp

Download
memory/580-59-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/580-62-0x0000000003248000-0x0000000003297000-memory.dmp

Filesize
316KB

Download
memory/580-63-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/580-65-0x0000000000220000-0x00000000002AE000-memory.dmp

Filesize
568KB

Download
memory/580-66-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download
memory/580-67-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/2044-57-0x0000000000400000-0x0000000002F68000-memory.dmp

Filesize
43.4MB

Download
memory/2044-56-0x0000000002F70000-0x0000000003002000-memory.dmp

Filesize
584KB

Download
memory/2044-58-0x0000000004910000-0x0000000004978000-memory.dmp

Filesize
416KB

Download
memory/2044-61-0x0000000003010000-0x00000000030A3000-memory.dmp

Filesize
588KB

Download
memory/2044-55-0x0000000000230000-0x00000000002AC000-memory.dmp

Filesize
496KB

Download