Analysis
- max time kernel
142s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
12/02/2022, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
f565aaf8728fcffc891df2314923e295.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f565aaf8728fcffc891df2314923e295.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target f565aaf8728fcffc891df2314923e295.exe
- Size 529KB
- Sample220212-zjptrsehgr
- SHA256 e7a411cdeff8c26a8d746d912e165f60699c01bb3d6fa433bb8475c59ef487a9
- MD5 f565aaf8728fcffc891df2314923e295
- SHA1 bec886e79de072ce5ec0766c585a41faaed52cf5
- SHA512 995b08b5d1f32207af9a4120bced71c37e249db01482d7217056d75e34d3a05ece8241cb1f22d458dc52bf196a4154705488e817bed72811ee005c3e174179be
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
1c0fad6805a0f65d7b597130eb9f089ffbe9857d
Attributes
-
url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar
rc4.plain
rc4.plain
Signatures
- suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4568 svchost.exe Token: SeCreatePagefilePrivilege 4568 svchost.exe Token: SeShutdownPrivilege 4568 svchost.exe Token: SeCreatePagefilePrivilege 4568 svchost.exe Token: SeShutdownPrivilege 4568 svchost.exe Token: SeCreatePagefilePrivilege 4568 svchost.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe Token: SeRestorePrivilege 1872 TiWorker.exe Token: SeSecurityPrivilege 1872 TiWorker.exe Token: SeBackupPrivilege 1872 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f565aaf8728fcffc891df2314923e295.exe"C:\Users\Admin\AppData\Local\Temp\f565aaf8728fcffc891df2314923e295.exe"1⤵PID:5016
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1872