Analysis
-
max time kernel
221s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13/01/2023, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-20220812-en
windows10-1703-x64
6 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
1800 seconds
General
-
Target
Setup.exe
-
Size
468.7MB
-
MD5
1ccbff5b7f0e9240288dc304b408683d
-
SHA1
6816a17240dfb5401e745aab50a70706a3573957
-
SHA256
57bd3423392a4825cc466ed4051789f5b99f5acfe222cefa348714d8b99dff0c
-
SHA512
ee2d3fa8e4e67eed670a3b0946471d8bb0857449f69c3198e9d5f0c8646503eef82d679d3dfee846fd34fd8434d4314735d90fe934d208c6bf56182db13d07f6
-
SSDEEP
49152:Un62QFJfD4IYSthbGa+YgOAv29U+IJ0pJTyn7TkXnE4F8:UhQF2Lghyru9a4Zy7TDy8
Malware Config
Extracted
Family
raccoon
Botnet
l����|
rc4.plain
Extracted
Family
raccoon
Botnet
8eb14caca01131f5f4ff62ef8a0fcab4
C2
http://77.75.230.25/
http://146.19.170.157/
rc4.plain
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1212 Setup.exe 1860 Setup.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1212 Setup.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1860 Setup.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1716 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 880 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 880 AUDIODG.EXE Token: 33 880 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 880 AUDIODG.EXE Token: SeDebugPrivilege 1716 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1212
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1316
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:880
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Passwords 123.txt1⤵PID:872
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1860