Analysis
-
max time kernel
98s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2023 02:19
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
6.7MB
-
MD5
570d50a75b897408c7e6ac71ce58f05c
-
SHA1
d9ef332a3ed7ec94bee34b79d86d858fe9610504
-
SHA256
d8ee018ff5de47956d2fb82a4f4c9e05a8b6a1af65e99bdd325e5e388c5bf4da
-
SHA512
6a37493995cdda39f90f80e8684be4694a03dfe533d632a0bc37acae05a641841f3350e1562719a90762febb11e8ac18b8e14e18c431a73ecf4f5e7ca41541cf
-
SSDEEP
98304:s2N71XVjYSIX9SquY8YSGA2rLHXYQhLZGVGzp9l1Y950EadPnUUPCmQU4y:VpXKSU9Huy3YQaVe/y0dUUPCml4y
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
20006ec55ea2d79e735051ae184a687c
C2
http://83.217.11.34
http://83.217.11.35
rc4.plain
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exepid process 3328 Setup.exe 3328 Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Setup.exepid process 3328 Setup.exe 3328 Setup.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3328-133-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/3328-134-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/3328-135-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/3328-136-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/3328-137-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/3328-138-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/3328-139-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/3328-140-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/3328-141-0x0000000000400000-0x0000000000E79000-memory.dmpFilesize
10.5MB