Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-03-2022 22:50
Static task
static1
Behavioral task
behavioral1
Sample
ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585.exe
Resource
win10v2004-en-20220113
General
-
Target
ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585.exe
-
Size
517KB
-
MD5
674aabf89c384e342acfbd2df44a7b20
-
SHA1
1f16ba82cd4b4e694877b2259710a445ff67369a
-
SHA256
ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585
-
SHA512
58915952f8feed668f1e2e9cd8cae0925233553c21118d0a325b4be852cacb777c00325e31c4717bde68c5c5dda82aab197c7c64722cf90d748d136c262b46f6
Malware Config
Extracted
raccoon
1c0fad6805a0f65d7b597130eb9f089ffbe9857d
-
url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar
Signatures
-
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
-
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2996 1556 WerFault.exe ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585.exe"C:\Users\Admin\AppData\Local\Temp\ecb1a50a574563743b502a4e931c4d236495c493894d2a50a3adb391486c4585.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 9762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1556 -ip 15561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1556-130-0x00000000006B1000-0x0000000000701000-memory.dmpFilesize
320KB
-
memory/1556-131-0x00000000006B1000-0x0000000000701000-memory.dmpFilesize
320KB
-
memory/1556-132-0x0000000002280000-0x0000000002312000-memory.dmpFilesize
584KB
-
memory/1556-133-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB