Analysis
-
max time kernel
34s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 03:01
Static task
static1
Behavioral task
behavioral1
Sample
setupsoftapp19.0.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
setupsoftapp19.0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
setupsoftapp19.0.exe
-
Size
846.9MB
-
MD5
c924d548d6362d6182a801e5ac9779a2
-
SHA1
ceef050c6d3476ba14afbcb7f9fae2383409f5b6
-
SHA256
692665962615caa30b77c4ac254668ed936d4025712d9338f272d6649f700698
-
SHA512
0c669977725c8808dac6570c7a2dc8071f3cc97679fdbdd348a458f421f400a94c4725306c503277c59d62e3cb0de634d739f13b48467715762e8a284b05af5d
-
SSDEEP
98304:4bAOzokQ2Kr/ar2QhHe8J7ouoFGxqMI8jZuF++U62mcx/:qc/V8J7ou31I4t+r
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
3f4a8564e5026a245d6974b020b3f6de
C2
http://45.15.156.225/
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 952 set thread context of 1280 952 setupsoftapp19.0.exe InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe PID 952 wrote to memory of 1280 952 setupsoftapp19.0.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-54-0x0000000001140000-0x0000000001F1C000-memory.dmpFilesize
13.9MB
-
memory/952-55-0x000000001BCE0000-0x000000001BF3E000-memory.dmpFilesize
2.4MB
-
memory/1280-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1280-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1280-59-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1280-61-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1280-63-0x00000000004088ED-mapping.dmp
-
memory/1280-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB