Resubmissions
27-04-2023 21:52
230427-1q5z1acb5t 1027-04-2023 21:45
230427-1mhqascb3v 1027-04-2023 21:38
230427-1g2afsab44 1027-04-2023 21:35
230427-1fckpsca8v 10Analysis
-
max time kernel
94s -
max time network
28s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2023 21:45
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
Setup.exe
-
Size
15.6MB
-
MD5
73f8b780611ace51cb61c01975afe06c
-
SHA1
5a6b70733e53f30e6f30b1ff59c19489f1248b51
-
SHA256
069494fedfdfd26cd90ee6614b3ce09884eb53c0bd8566f9e70d55243c44b5a6
-
SHA512
fb731560a41f87420e632cc8992ff8f764904011c367d7c7290dc88ac76730de894bbd371bc9f27186b9577fe03f19463842a73b993d1b5f3a3bde631839f92b
-
SSDEEP
196608:A0RgGF79cVhrirDBFsYPVM6TWn7/m80aslB4ZJdDhpp0Bz6P2fAz1TPTYEtm96m5:XycYIDBKl7O80zlgJpJ0BI2fU3X0D5
Malware Config
Extracted
raccoon
717609e6131226f92ce8ce08c34305be
http://37.220.87.66/
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exepid process 1788 Setup.exe 1788 Setup.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Setup.exepid process 1788 Setup.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1316 AUDIODG.EXE Token: 33 1316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1316 AUDIODG.EXE
Processes
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1501⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1788-54-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1788-55-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1788-56-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1788-57-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1788-58-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1788-59-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1788-60-0x0000000000400000-0x0000000001E02000-memory.dmpFilesize
26.0MB