Analysis
-
max time kernel
91s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 07:01
Static task
static1
Behavioral task
behavioral1
Sample
setupsoftapp19.0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
setupsoftapp19.0.exe
Resource
win10v2004-20221111-en
General
-
Target
setupsoftapp19.0.exe
-
Size
762.9MB
-
MD5
17aaa592f0b1bd973f5f66a4dfa728dc
-
SHA1
31f91c8e2349ebd94ab4170f856d7ca6b65b4143
-
SHA256
e96809c130f1387f78a72e0ad4280a13aa10223aaacb3388cf3e8971e2b14c86
-
SHA512
565c4dff550206ffac85e9e9482b00d8859c79208889b9bd7741530d218c18576b41a5fbba08513595e3ae9bb351d66a775fa99c0cc2522af7551af2e1fe0a32
-
SSDEEP
98304:SIAzUE2bRCunvAdP4lLBYHHm/+MJXzdG7cLwE0xYhrRx4S/HzL71hY:SIKU4uodQjAUJxG7c0EIYJ/4S/TL70
Malware Config
Extracted
raccoon
3f4a8564e5026a245d6974b020b3f6de
http://45.15.156.225/
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 2716 set thread context of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe PID 2716 wrote to memory of 3004 2716 setupsoftapp19.0.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2716-132-0x0000000000190000-0x00000000010A2000-memory.dmpFilesize
15.1MB
-
memory/2716-133-0x00007FF9A9160000-0x00007FF9A9C21000-memory.dmpFilesize
10.8MB
-
memory/2716-139-0x00007FF9A9160000-0x00007FF9A9C21000-memory.dmpFilesize
10.8MB
-
memory/3004-134-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3004-135-0x00000000004088ED-mapping.dmp
-
memory/3004-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3004-138-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3004-140-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB