Analysis
-
max time kernel
87s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2022 13:40
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
300 seconds
General
-
Target
Setup.exe
-
Size
428.0MB
-
MD5
9d2b9885fdb0885ac11bd944c86c4655
-
SHA1
eeeebef1fd514f1b697158c990ba94b9c752374c
-
SHA256
ef70efe0a3cd860831657fa7ee8d832d49c8d8489df4b35d2480cc043bbb1b04
-
SHA512
6ca0fe74cec6b22e9d9da927614cfed8440d153f8852fc938b7f156b95c29ddca7b652557635ebb6aa7197ad37c0a09d475deedddc44316ddac929cdac7b4813
-
SSDEEP
98304:b8vH233wZUFkCNauJm+UPp7WMZwa/jOTN:bowwP+UxaMZxbOT
Malware Config
Extracted
Family
raccoon
Botnet
b4f472421ce1f18efd9f610339c3dae1
C2
http://77.73.134.30/
rc4.plain
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe -
Processes:
resource yara_rule behavioral2/memory/4620-134-0x0000000000D90000-0x0000000001742000-memory.dmp themida behavioral2/memory/4620-139-0x0000000000D90000-0x0000000001742000-memory.dmp themida -
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 4620 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 4620 set thread context of 3372 4620 Setup.exe InstallUtil.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Setup.exedescription pid process target process PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe PID 4620 wrote to memory of 3372 4620 Setup.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3372-137-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3372-138-0x00000000004088B5-mapping.dmp
-
memory/3372-143-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3372-144-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4620-132-0x0000000000D90000-0x0000000001742000-memory.dmpFilesize
9.7MB
-
memory/4620-134-0x0000000000D90000-0x0000000001742000-memory.dmpFilesize
9.7MB
-
memory/4620-135-0x00007FFA11CD0000-0x00007FFA11EC5000-memory.dmpFilesize
2.0MB
-
memory/4620-136-0x00007FF9F3B20000-0x00007FF9F45E1000-memory.dmpFilesize
10.8MB
-
memory/4620-139-0x0000000000D90000-0x0000000001742000-memory.dmpFilesize
9.7MB
-
memory/4620-140-0x00007FFA11CD0000-0x00007FFA11EC5000-memory.dmpFilesize
2.0MB
-
memory/4620-142-0x00007FF9F3B20000-0x00007FF9F45E1000-memory.dmpFilesize
10.8MB