Analysis
-
max time kernel
86s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 18:44
Static task
static1
Behavioral task
behavioral1
Sample
filesetup_v17.3.4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
filesetup_v17.3.4.exe
Resource
win10v2004-20221111-en
General
-
Target
filesetup_v17.3.4.exe
-
Size
694.8MB
-
MD5
849969eee450278d949286e3cf2e49fa
-
SHA1
c7aa87546edb8768afae08a3a6f5c30dd1934042
-
SHA256
63bfe18c23479fb787df25a84cb7e54d76528fdea1532b2b034f00b41b7cc923
-
SHA512
fb59a22784d86bc72f285d6d6ebae433de82e16ed0baa5a5dfb35619559f96977d2b6898b4fa7b5cc85ebebfd1c371b686810518ccc6e90c7a835f033bca6651
-
SSDEEP
12288:i1Bb9l5UFIM1mKtWJUSw30mav4C5Go8lA2Qp32zYsALPm1ir/khIjuDepZa2RCjt:i1RxkIM1K1q
Malware Config
Extracted
raccoon
058b163252af946c77f376d3f457096b
http://160.119.253.242
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 9 3800 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
powershell.exepid process 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3800 set thread context of 4756 3800 powershell.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3800 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
filesetup_v17.3.4.exepowershell.exedescription pid process target process PID 2940 wrote to memory of 3800 2940 filesetup_v17.3.4.exe powershell.exe PID 2940 wrote to memory of 3800 2940 filesetup_v17.3.4.exe powershell.exe PID 2940 wrote to memory of 3800 2940 filesetup_v17.3.4.exe powershell.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe PID 3800 wrote to memory of 4756 3800 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\filesetup_v17.3.4.exe"C:\Users\Admin\AppData\Local\Temp\filesetup_v17.3.4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2940-132-0x0000000000EE0000-0x0000000000F24000-memory.dmpFilesize
272KB
-
memory/2940-133-0x0000000005E20000-0x00000000063C4000-memory.dmpFilesize
5.6MB
-
memory/2940-134-0x00000000057A0000-0x0000000005832000-memory.dmpFilesize
584KB
-
memory/2940-135-0x0000000003320000-0x000000000332A000-memory.dmpFilesize
40KB
-
memory/3800-136-0x0000000000000000-mapping.dmp
-
memory/3800-137-0x00000000023E0000-0x0000000002416000-memory.dmpFilesize
216KB
-
memory/3800-138-0x0000000004F20000-0x0000000005548000-memory.dmpFilesize
6.2MB
-
memory/3800-139-0x0000000004CF0000-0x0000000004D12000-memory.dmpFilesize
136KB
-
memory/3800-140-0x0000000004DB0000-0x0000000004E16000-memory.dmpFilesize
408KB
-
memory/3800-141-0x0000000004E20000-0x0000000004E86000-memory.dmpFilesize
408KB
-
memory/3800-142-0x0000000005CF0000-0x0000000005D0E000-memory.dmpFilesize
120KB
-
memory/3800-143-0x0000000006240000-0x0000000006284000-memory.dmpFilesize
272KB
-
memory/3800-144-0x0000000006FC0000-0x0000000007036000-memory.dmpFilesize
472KB
-
memory/3800-145-0x00000000076C0000-0x0000000007D3A000-memory.dmpFilesize
6.5MB
-
memory/3800-146-0x0000000007060000-0x000000000707A000-memory.dmpFilesize
104KB
-
memory/4756-147-0x0000000000000000-mapping.dmp
-
memory/4756-148-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4756-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4756-151-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB