Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 03:01
Static task
static1
Behavioral task
behavioral1
Sample
setupsoftapp19.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
setupsoftapp19.0.exe
Resource
win10v2004-20220812-en
General
-
Target
setupsoftapp19.0.exe
-
Size
846.9MB
-
MD5
c924d548d6362d6182a801e5ac9779a2
-
SHA1
ceef050c6d3476ba14afbcb7f9fae2383409f5b6
-
SHA256
692665962615caa30b77c4ac254668ed936d4025712d9338f272d6649f700698
-
SHA512
0c669977725c8808dac6570c7a2dc8071f3cc97679fdbdd348a458f421f400a94c4725306c503277c59d62e3cb0de634d739f13b48467715762e8a284b05af5d
-
SSDEEP
98304:4bAOzokQ2Kr/ar2QhHe8J7ouoFGxqMI8jZuF++U62mcx/:qc/V8J7ou31I4t+r
Malware Config
Extracted
raccoon
3f4a8564e5026a245d6974b020b3f6de
http://45.15.156.225/
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EAD48405-9490-4B6E-8D54-5F399EAFB2F9}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F3E401D0-5E46-402C-950F-31544108E0B5}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 1752 set thread context of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1360 2156 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe PID 1752 wrote to memory of 2416 1752 setupsoftapp19.0.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 2156 -ip 21561⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2156 -s 22681⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1752-132-0x000001F31C4C0000-0x000001F31D29C000-memory.dmpFilesize
13.9MB
-
memory/1752-133-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/1752-138-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/2416-134-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2416-135-0x00000000004088ED-mapping.dmp
-
memory/2416-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2416-139-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2416-140-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB