analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

abc.zip

Full analysis: https://app.any.run/tasks/ff86637b-2853-4fd8-b343-7ebae643653d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 05, 2022, 06:24:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BA7625052FA34457D8C60DB5FE993C79

SHA1:

2E114BBC37E6CDE605A773786072AD42D6FE1B6B

SHA256:

41362342AB7447A7AA166E979114694AD77B2A30C846A6F9B482ABFADAC5A2BC

SSDEEP:

196608:eqr1RcNTJp02muFP38NqFM41Rrrr3IsoC8nb4D:ek1QG2mBovoCs4D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • abc.exe (PID: 1208)
    • Application was dropped or rewritten from another process

      • pR2qx4Ze.exe (PID: 3956)
      • pR2qx4Ze.exe (PID: 1992)
    • RACCOON was detected

      • abc.exe (PID: 1208)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs #RACCOON abc.exe pr2qx4ze.exe no specs pr2qx4ze.exe regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2460"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\abc.zip"C:\Program Files\WinRAR\WinRAR.exeExplorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
1208"C:\Users\admin\Desktop\abc.exe" C:\Users\admin\Desktop\abc.exe
Explorer.EXE
User:
admin
Company:
R-Tools Technology
Integrity Level:
MEDIUM
Description:
RDI Command Line extension
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
1992"C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe" C:\Users\admin\AppData\Roaming\pR2qx4Ze.exeabc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\pr2qx4ze.exe
c:\windows\system32\ntdll.dll
3956"C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe" C:\Users\admin\AppData\Roaming\pR2qx4Ze.exe
abc.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\roaming\pr2qx4ze.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4012"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
pR2qx4Ze.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 193
Read events
7 135
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
6
Text files
2
Unknown types
9

Dropped files

PID
Process
Filename
Type
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565der
MD5:DBE650BA1D1EB0B65CB29924AB369F1B
SHA256:2DF229C762B997F438A51379186347842250A82FC3C1234FAFB0781C9276E636
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:101F34D36C918168E0C418E4CDBEAA54
SHA256:0BC62904D8DA9EE4E150AA53870A8ABBCE7D32FAD59C3CB19FD4E8FE4156FAF1
1208abc.exeC:\Users\admin\AppData\LocalLow\GTAvwgPJ4eiMsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
1208abc.exeC:\Users\admin\AppData\LocalLow\yeJ18vl14l6xsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
1208abc.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
1208abc.exeC:\Users\admin\AppData\LocalLow\nss3.dllexecutable
MD5:F67D08E8C02574CBC2F1122C53BFB976
SHA256:C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
1208abc.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
1208abc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5550AA51E5A72D16C61FD6676F01829C
SHA256:8E73D15084F656BB53599C8B724753DA48482A89F7B7E008C25AF651E4097413
1208abc.exeC:\Users\admin\AppData\Local\Temp\3nd49FV4.exe
MD5:
SHA256:
1208abc.exeC:\Users\admin\AppData\LocalLow\x5c8e6JefvpOsqlite
MD5:CC104C4E4E904C3AD7AD5C45FBFA7087
SHA256:321BE844CECC903EF1E7F875B729C96BB3ED0D4986314384CD5944A29A670C9B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1208
abc.exe
POST
200
137.74.107.184:80
http://137.74.107.184/
FR
text
7.04 Kb
malicious
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAUYmlTr6MfpA%2BCrDZJVRd4%3D
US
der
313 b
whitelisted
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
FR
executable
1.95 Mb
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
FR
executable
612 Kb
malicious
1208
abc.exe
POST
200
137.74.107.184:80
http://137.74.107.184/816be5d466e46da835af7938e9dbc87e
FR
text
8 b
malicious
1208
abc.exe
POST
200
137.74.107.184:80
http://137.74.107.184/816be5d466e46da835af7938e9dbc87e
FR
text
8 b
malicious
1208
abc.exe
GET
200
137.74.107.184:80
http://137.74.107.184/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
FR
executable
78.2 Kb
malicious
1208
abc.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b060673f084517b
US
compressed
4.70 Kb
whitelisted
1208
abc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1208
abc.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
1208
abc.exe
137.74.107.184:80
OVH SAS
FR
malicious
1208
abc.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1208
abc.exe
185.199.110.133:443
objects.githubusercontent.com
FASTLY
US
malicious
1208
abc.exe
140.82.121.3:443
github.com
GITHUB
US
suspicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
objects.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
shared

Threats

PID
Process
Class
Message
1208
abc.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin M1
1208
abc.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1208
abc.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
No debug info