analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

160a37cda657d7f373478df74cf5d316.exe

Full analysis: https://app.any.run/tasks/dc5db9e0-f92a-4711-963c-371831a0cf1e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 05, 2022, 17:46:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

160A37CDA657D7F373478DF74CF5D316

SHA1:

4A5EBCFAFA481F3F87874A63CF5865A213917274

SHA256:

0717C266EAE6BC114948C106E886C2CB8A488AAA28EABB9C2DFC9CAF27AC911D

SSDEEP:

6144:geE0WCLnQX46PiAdNF5mi21ojc5dVX3kENvGGGGGGGGHGGGGGGGGGGGGGGGGGGGM:ggWCLQIClF5m53VX3pNgp1aUK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Connects to the CnC server

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • RACCOON was detected

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Drops the executable file immediately after the start

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Loads dropped or rewritten executable

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
  • SUSPICIOUS

    • Reads the Internet Settings

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Reads settings of System Certificates

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
    • Detected use of alternative data streams (AltDS)

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
    • Application launched itself

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
    • Process drops Mozilla's DLL files

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Process requests binary or script from the Internet

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Connects to the server without a host name

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Searches for installed software

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Process checks DPAPI master keys

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Reads browser cookies

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Process drops SQLite DLL files

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Starts application from unusual location

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
  • INFO

    • Reads the computer name

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Reads Environment values

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Checks supported languages

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 2724)
      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Checks proxy server information

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Drops a file that was compiled in debug mode

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Reads product name

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
    • Process looks inside Credentials folder

      • 160a37cda657d7f373478df74cf5d316.exe (PID: 3992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 1975-Jan-23 07:43:36
Detected languages:
  • English - United States
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.62.0
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.62.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.62.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 1975-Jan-23 07:43:36
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
320500
320512
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.35705
.rsrc
335872
111873
112128
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.79375
.reloc
450560
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0815394

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.16096
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON
50
2.91531
1384
UNKNOWN
UNKNOWN
RT_ICON
51
4.66044
2216
UNKNOWN
UNKNOWN
RT_ICON
52
5.16834
3752
UNKNOWN
UNKNOWN
RT_ICON
53
3.69314
9640
UNKNOWN
UNKNOWN
RT_ICON
54
7.97032
18525
UNKNOWN
UNKNOWN
RT_ICON
55
5.08627
67624
UNKNOWN
UNKNOWN
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
104
2.70411
344
UNKNOWN
English - United States
RT_DIALOG

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 160a37cda657d7f373478df74cf5d316.exe #RACCOON 160a37cda657d7f373478df74cf5d316.exe

Process information

PID
CMD
Path
Indicators
Parent process
2724"C:\Users\admin\AppData\Local\Temp\160a37cda657d7f373478df74cf5d316.exe" C:\Users\admin\AppData\Local\Temp\160a37cda657d7f373478df74cf5d316.exe
Explorer.EXE
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.62.0
Modules
Images
c:\users\admin\appdata\local\temp\160a37cda657d7f373478df74cf5d316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3992"C:\Users\admin\AppData\Local\Temp\160a37cda657d7f373478df74cf5d316.exe"C:\Users\admin\AppData\Local\Temp\160a37cda657d7f373478df74cf5d316.exe
160a37cda657d7f373478df74cf5d316.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.62.0
Modules
Images
c:\users\admin\appdata\local\temp\160a37cda657d7f373478df74cf5d316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 528
Read events
4 482
Write events
46
Delete events
0

Modification events

(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2724) 160a37cda657d7f373478df74cf5d316.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\160a37cda657d7f373478df74cf5d316_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
7
Suspicious files
1
Text files
3
Unknown types
6

Dropped files

PID
Process
Filename
Type
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\8gdwKlceHPrtimage
MD5:9A129FF03A3EF3D4CA0FC7B304C96D58
SHA256:1E48424AE41482508661D8F2C9905A6362A99E1C7E83FE8817803521BA9A1311
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\0KAl5XmfTELbsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\Dx2fAqmUa26isqlite
MD5:CC104C4E4E904C3AD7AD5C45FBFA7087
SHA256:321BE844CECC903EF1E7F875B729C96BB3ED0D4986314384CD5944A29A670C9B
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\sqlite3.dllexecutable
MD5:DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA256:47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\nss3.dllexecutable
MD5:F67D08E8C02574CBC2F1122C53BFB976
SHA256:C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\VLkrPOF68Z7mtext
MD5:16137445CEBCECA2926FE761FCDDF5B5
SHA256:186D99A8E7BC4C3DF1D05706836F19C42A53BECE231CF7F1256BE1F09079C7D5
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\ONL98gXz9K60sqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
3992160a37cda657d7f373478df74cf5d316.exeC:\Users\admin\AppData\LocalLow\5hP4wd00skF7sqlite
MD5:49E1E66E8EEFE2553D2ECEC4B7EF1D3E
SHA256:A664C359ACE3BFC149323E5403BB7140A84519043BDBA59B064EBC1BDADD32D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3992
160a37cda657d7f373478df74cf5d316.exe
POST
200
74.119.195.225:80
http://74.119.195.225/
NL
text
7.27 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
NL
executable
1.05 Mb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
NL
executable
612 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
NL
executable
78.2 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
NL
executable
668 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
NL
executable
438 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
NL
executable
248 Kb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
GET
200
74.119.195.225:80
http://74.119.195.225/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
NL
executable
1.95 Mb
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
POST
200
74.119.195.225:80
http://74.119.195.225/e8797adb3005cf521a9ce769a4765191
NL
text
8 b
malicious
3992
160a37cda657d7f373478df74cf5d316.exe
POST
200
74.119.195.225:80
http://74.119.195.225/e8797adb3005cf521a9ce769a4765191
NL
text
8 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3992
160a37cda657d7f373478df74cf5d316.exe
74.119.195.225:80
Stark Industries Solutions Ltd
NL
malicious
2724
160a37cda657d7f373478df74cf5d316.exe
142.250.186.100:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.100
whitelisted

Threats

PID
Process
Class
Message
3992
160a37cda657d7f373478df74cf5d316.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin M1
3992
160a37cda657d7f373478df74cf5d316.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3992
160a37cda657d7f373478df74cf5d316.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info