Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 21:05
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20211026-230331.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
mixsix_20211026-230331.exe
Resource
win10-en-20210920
General
-
Target
mixsix_20211026-230331.exe
-
Size
649KB
-
MD5
0f2c6fea427d273ea705cb397229ea1c
-
SHA1
f8a7502b1773dcc92b62cae9fc52fbf2c48cddd0
-
SHA256
ce446701e5909550dcea95e229a76de9dab64b8f1642daa4f92c11a8bcd10771
-
SHA512
605d6ee544ac3dc103e7effc687494e49bfd831fbef9b1df77c9f5ce58e9f699991c5f83a9ab490593adbf15f0f1d38bb675b9e56b62863f3b1a310eb960a14c
Malware Config
Extracted
raccoon
7c9b4504a63ed23664e38808e65948379b790395
-
url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 420 created 4324 420 WerFault.exe mixsix_20211026-230331.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20211026-230331.exedescription pid process target process PID 4072 set thread context of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 420 4324 WerFault.exe mixsix_20211026-230331.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe 420 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 420 WerFault.exe Token: SeBackupPrivilege 420 WerFault.exe Token: SeDebugPrivilege 420 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
mixsix_20211026-230331.exedescription pid process target process PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe PID 4072 wrote to memory of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 11683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4072-115-0x0000000004BE0000-0x0000000004C5C000-memory.dmpFilesize
496KB
-
memory/4072-116-0x0000000004C60000-0x0000000004CF2000-memory.dmpFilesize
584KB
-
memory/4072-117-0x0000000000400000-0x0000000002F68000-memory.dmpFilesize
43.4MB
-
memory/4072-118-0x0000000003102000-0x000000000316B000-memory.dmpFilesize
420KB
-
memory/4072-119-0x0000000004D00000-0x0000000004D93000-memory.dmpFilesize
588KB
-
memory/4324-121-0x0000000000457320-mapping.dmp
-
memory/4324-120-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB
-
memory/4324-122-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB
-
memory/4324-123-0x00000000030B4000-0x0000000003103000-memory.dmpFilesize
316KB
-
memory/4324-124-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB
-
memory/4324-125-0x0000000002ED0000-0x000000000301A000-memory.dmpFilesize
1.3MB
-
memory/4324-126-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB