raccoon | ce446701e5909550dcea95e229a76de9dab64b8f1642daa4f92c11a8bcd10771

General

Target

mixsix_20211026-230331.exe
Size

649KB
MD5

0f2c6fea427d273ea705cb397229ea1c
SHA1

f8a7502b1773dcc92b62cae9fc52fbf2c48cddd0
SHA256

ce446701e5909550dcea95e229a76de9dab64b8f1642daa4f92c11a8bcd10771
SHA512

605d6ee544ac3dc103e7effc687494e49bfd831fbef9b1df77c9f5ce58e9f699991c5f83a9ab490593adbf15f0f1d38bb675b9e56b62863f3b1a310eb960a14c

Score

10^/10

raccoon 7c9b4504a63ed23664e38808e65948379b790395 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 420 created 4324 420 WerFault.exe mixsix_20211026-230331.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

mixsix_20211026-230331.exe

description pid process target process

PID 4072 set thread context of 4324 4072 mixsix_20211026-230331.exe mixsix_20211026-230331.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

420 4324 WerFault.exe mixsix_20211026-230331.exe

description	pid	process	target process
PID 420 created 4324	420	WerFault.exe	mixsix_20211026-230331.exe

description	pid	process	target process
PID 4072 set thread context of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe

pid	pid_target	process	target process
420	4324	WerFault.exe	mixsix_20211026-230331.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 420 WerFault.exe
Token: SeBackupPrivilege 420 WerFault.exe
Token: SeDebugPrivilege 420 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	420	WerFault.exe
Token: SeBackupPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	420	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

mixsix_20211026-230331.exe

description	pid	process	target process
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe
PID 4072 wrote to memory of 4324	4072	mixsix_20211026-230331.exe	mixsix_20211026-230331.exe

C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe
"C:\Users\Admin\AppData\Local\Temp\mixsix_20211026-230331.exe"
2⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1168
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-115-0x0000000004BE0000-0x0000000004C5C000-memory.dmp

Filesize
496KB

Download
memory/4072-116-0x0000000004C60000-0x0000000004CF2000-memory.dmp

Filesize
584KB

Download
memory/4072-117-0x0000000000400000-0x0000000002F68000-memory.dmp

Filesize
43.4MB

Download
memory/4072-118-0x0000000003102000-0x000000000316B000-memory.dmp

Filesize
420KB

Download
memory/4072-119-0x0000000004D00000-0x0000000004D93000-memory.dmp

Filesize
588KB

Download
memory/4324-121-0x0000000000457320-mapping.dmp

Download
memory/4324-120-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4324-122-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4324-123-0x00000000030B4000-0x0000000003103000-memory.dmp

Filesize
316KB

Download
memory/4324-124-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4324-125-0x0000000002ED0000-0x000000000301A000-memory.dmp

Filesize
1.3MB

Download
memory/4324-126-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download

Analysis

Sharing