Analysis
-
max time kernel
144s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26/03/2023, 23:43
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
setup.exe
-
Size
9.8MB
-
MD5
a417a25a29d1e25d545eb4d5fac008ed
-
SHA1
a10b247168a16aa0e0d333903d0c381c1fb72157
-
SHA256
dce93b967a62d16f95ce6b36bae49e5e409c433c0e2cdf29f1afca2cf2f80f2c
-
SHA512
b161a4298da511336b07bb7b44d54286a01ef62a9e0814ce2454b40c6b556cd93f420dcb7411f46c4f738986ba175686af7bf8ddd14e240bc4bb6d305e335803
-
SSDEEP
196608:K3yQvf7t9WepdCO/UsaXcGORRdZHQZ0oWM0TwQAvNIzw5jCRjtT:GB9WepdCb+lRR7QZ0oWVwTxjCR
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
7af851c87aaae953215cdfcef767dccb
C2
http://45.9.74.170
http://77.73.134.43
rc4.plain
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2040 setup.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1100 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100