Analysis
-
max time kernel
63s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 14:26
Static task
static1
Behavioral task
behavioral1
Sample
Autodesk.AutoCAD.2022.1.1.en.exe
Resource
win7-20221111-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Autodesk.AutoCAD.2022.1.1.en.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Autodesk.AutoCAD.2022.1.1.en.exe
-
Size
6MB
-
MD5
67d56c44c8097f14018b2a9bd9f671cd
-
SHA1
5c35f05d59106ce7850428a403f037e80d198a17
-
SHA256
1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c
-
SHA512
7aa3e714eb8c3aca57f37ec0ad2dd713feea5ace7b3b2056a9ddc2a60616e069a3eeb362f74e4c635d551b4f0acf1fb23d1a655a9b15d0c1726e70b1c49c4ff2
-
SSDEEP
196608:xmD/cRu3LyA8OYtgd/bS/4jqJK7nmLAqqY:xmq5KjS/ojnBS
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
4ee4e2ee5aa36d394f5d44408a602375
C2
http://168.119.60.182/
rc4.plain
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Autodesk.AutoCAD.2022.1.1.en.exepid process 1096 Autodesk.AutoCAD.2022.1.1.en.exe 1096 Autodesk.AutoCAD.2022.1.1.en.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Autodesk.AutoCAD.2022.1.1.en.exepid process 1096 Autodesk.AutoCAD.2022.1.1.en.exe 1096 Autodesk.AutoCAD.2022.1.1.en.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-132-0x0000000000400000-0x0000000000DAF000-memory.dmpFilesize
9MB
-
memory/1096-134-0x0000000000400000-0x0000000000DAF000-memory.dmpFilesize
9MB
-
memory/1096-135-0x0000000000400000-0x0000000000DAF000-memory.dmpFilesize
9MB
-
memory/1096-136-0x0000000000400000-0x0000000000DAF000-memory.dmpFilesize
9MB