Analysis
- max time kernel
117s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
02/01/2022, 18:19
General
- Target c085684db882063c21f18d251679b0cc.exe
- Size 743KB
- Sample220102-wx64esafe9
- SHA256 cda92bb8e0734752dc6366275020ce48d75f95d78af9793b40512895ecd2d470
Malware Config
Extracted
-
raccoon
-
10da56e7e71e97bdc1f36eb76813bbc3231de7e4
-
url4cnc
http://194.180.174.53/capibar
http://91.219.236.18/capibar
http://194.180.174.41/capibar
http://91.219.236.148/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c085684db882063c21f18d251679b0cc.exe"C:\Users\Admin\AppData\Local\Temp\c085684db882063c21f18d251679b0cc.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 11842⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2448-116-0x0000000000CC0000-0x0000000000D57000-memory.dmp
memory/2448-117-0x0000000000400000-0x0000000000885000-memory.dmp
memory/2448-118-0x000000000092C000-0x0000000000989000-memory.dmp
memory/2448-119-0x0000000000400000-0x0000000000885000-memory.dmp
memory/2448-120-0x0000000002740000-0x00000000027D5000-memory.dmp
memory/2448-121-0x0000000000400000-0x0000000000885000-memory.dmp
memory/2448-122-0x0000000000400000-0x0000000000885000-memory.dmp
memory/2448-123-0x0000000000E00000-0x0000000000E50000-memory.dmp
memory/2448-124-0x0000000002930000-0x00000000029C2000-memory.dmp
memory/2448-125-0x0000000000400000-0x0000000000885000-memory.dmp