File name:

abc.zip

Full analysis: https://app.any.run/tasks/ff86637b-2853-4fd8-b343-7ebae643653d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 05, 2022, 06:24:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BA7625052FA34457D8C60DB5FE993C79

SHA1:

2E114BBC37E6CDE605A773786072AD42D6FE1B6B

SHA256:

41362342AB7447A7AA166E979114694AD77B2A30C846A6F9B482ABFADAC5A2BC

SSDEEP:

196608:eqr1RcNTJp02muFP38NqFM41Rrrr3IsoC8nb4D:ek1QG2mBovoCs4D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • pR2qx4Ze.exe (PID: 1992)
      • pR2qx4Ze.exe (PID: 3956)
    • Loads dropped or rewritten executable

      • abc.exe (PID: 1208)
    • RACCOON was detected

      • abc.exe (PID: 1208)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs #RACCOON abc.exe pr2qx4ze.exe no specs pr2qx4ze.exe regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
1208"C:\Users\admin\Desktop\abc.exe" C:\Users\admin\Desktop\abc.exe
Explorer.EXE
User:
admin
Company:
R-Tools Technology
Integrity Level:
MEDIUM
Description:
RDI Command Line extension
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
1992"C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe" C:\Users\admin\AppData\Roaming\pR2qx4Ze.exeabc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\pr2qx4ze.exe
c:\windows\system32\ntdll.dll
2460"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\abc.zip"C:\Program Files\WinRAR\WinRAR.exeExplorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3956"C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe" C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe
abc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\roaming\pr2qx4ze.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4012"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
pR2qx4Ze.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 193
Read events
7 135
Write events
58
Delete events
0

Modification events

(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2460) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\abc.zip
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
9
Suspicious files
6
Text files
2
Unknown types
9

Dropped files

PID
Process
Filename
Type
1208abc.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
1208abc.exeC:\Users\admin\AppData\LocalLow\freebl3.dllexecutable
MD5:15B61E4A910C172B25FB7D8CCB92F754
SHA256:B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
1208abc.exeC:\Users\admin\AppData\LocalLow\S87dQswsoR55sqlite
MD5:D02907BE1C995E1E51571EEDB82FA281
SHA256:2189977F6EA58BDAD5883720B099E12B869F223FB9B18AC40E7D37C5954A55DD
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565der
MD5:
SHA256:
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:
SHA256:
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:
SHA256:
1208abc.exeC:\Users\admin\AppData\LocalLow\yeJ18vl14l6xsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
1208abc.exeC:\Users\admin\AppData\Local\Temp\3nd49FV4.exe
MD5:
SHA256:
1208abc.exeC:\Users\admin\AppData\LocalLow\R9woTc4Iu4hOsqlite
MD5:D02907BE1C995E1E51571EEDB82FA281
SHA256:2189977F6EA58BDAD5883720B099E12B869F223FB9B18AC40E7D37C5954A55DD
1208abc.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
8
DNS requests
4
Threats
320

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1208
abc.exe
POST
200
137.74.107.184:80
http://137.74.107.184/
FR
text
7.04 Kb
malicious
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAUYmlTr6MfpA%2BCrDZJVRd4%3D
US
der
313 b
whitelisted
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
FR
executable
438 Kb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
FR
executable
612 Kb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
FR
executable
1.95 Mb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
FR
executable
78.2 Kb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
FR
executable
248 Kb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
FR
executable
668 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1208
abc.exe
140.82.121.3:443
github.com
GITHUB
US
suspicious
1208
abc.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1208
abc.exe
137.74.107.184:80
OVH SAS
FR
malicious
1208
abc.exe
185.199.110.133:443
objects.githubusercontent.com
FASTLY
US
malicious
1208
abc.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
malicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
objects.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
shared

Threats

PID
Process
Class
Message
1208
abc.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin M1
1208
abc.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
No debug info