Overview
overview
10Static
static
1Language/WinRar.exe
windows7-x64
10Language/WinRar.exe
windows10-2004-x64
10Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
10en-US/Auto...eN.dll
windows7-x64
1en-US/Auto...eN.dll
windows10-2004-x64
1en-US/avicap32.dll
windows7-x64
1en-US/avicap32.dll
windows10-2004-x64
1vcomp140.dll
windows7-x64
1vcomp140.dll
windows10-2004-x64
3vcruntime140.dll
windows7-x64
3vcruntime140.dll
windows10-2004-x64
3win-api.xml
windows7-x64
1win-api.xml
windows10-2004-x64
1Analysis
-
max time kernel
98s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
submitted
21-02-2023 11:28
Static task
static1
Behavioral task
behavioral1
Sample
Language/WinRar.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Language/WinRar.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
en-US/AutoWorkplaceN.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
en-US/AutoWorkplaceN.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
en-US/avicap32.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
en-US/avicap32.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
vcomp140.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
vcomp140.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
vcruntime140.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
vcruntime140.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
win-api.xml
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
win-api.xml
Resource
win10v2004-20230220-en
General
-
Target
Setup.exe
Malware Config
Extracted
raccoon
697fc5d9af6aa2a29510779d2fc54b97
http://83.217.11.27/
http://83.217.11.28/
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exepid process 4252 Setup.exe 4252 Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Setup.exepid process 4252 Setup.exe 4252 Setup.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4252-133-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/4252-134-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/4252-135-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/4252-136-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/4252-137-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/4252-138-0x0000000001090000-0x0000000001091000-memory.dmpFilesize
4KB
-
memory/4252-139-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/4252-140-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/4252-141-0x0000000000400000-0x0000000000F1F000-memory.dmpFilesize
11.1MB