analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SetupFile.bin

Full analysis: https://app.any.run/tasks/6932fea4-7b5c-4002-828e-4c15c6c8f6e1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 31, 2023, 23:27:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
raccoon
recordbreaker
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B66BAD3F04BCB6C019F8675E12445492

SHA1:

80D448D75A2209CA3FB0C9C99262BABB49EE5D8E

SHA256:

78C47BCEC66944351AD26FBB22565CCA7268099A47250518B0D51A43F677C236

SSDEEP:

196608:NYzLzScvgh3AADZ7sMHEXBhb8Jrznl32LUTxqLrkSdNMjGYQcH7WTyCWxxPajesR:mjScvgh3A4dLHEx0rILKxC3+bGy96ey

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RACCOON was detected

      • SetupFile.bin.exe (PID: 3348)

    • Connects to the CnC server

      • SetupFile.bin.exe (PID: 3348)

    • Application was dropped or rewritten from another process

      • kCc2B9Ze.exe (PID: 3204)

    • Actions looks like stealing of personal data

      • SetupFile.bin.exe (PID: 3348)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SetupFile.bin.exe (PID: 3348)

    • Process requests binary or script from the Internet

      • SetupFile.bin.exe (PID: 3348)

    • Connects to the server without a host name

      • SetupFile.bin.exe (PID: 3348)

    • Searches for installed software

      • SetupFile.bin.exe (PID: 3348)

    • Reads browser cookies

      • SetupFile.bin.exe (PID: 3348)

    • Executable content was dropped or overwritten

      • SetupFile.bin.exe (PID: 3348)

  • INFO

    • Checks supported languages

      • SetupFile.bin.exe (PID: 3348)
      • kCc2B9Ze.exe (PID: 3204)

    • Reads the machine GUID from the registry

      • SetupFile.bin.exe (PID: 3348)

    • Checks proxy server information

      • SetupFile.bin.exe (PID: 3348)

    • Reads the computer name

      • SetupFile.bin.exe (PID: 3348)

    • The process checks LSA protection

      • SetupFile.bin.exe (PID: 3348)

    • Creates files or folders in the user directory

      • SetupFile.bin.exe (PID: 3348)

    • Reads product name

      • SetupFile.bin.exe (PID: 3348)

    • Reads Environment values

      • SetupFile.bin.exe (PID: 3348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x17b43cf
UninitializedDataSize: -
InitializedDataSize: 325632
CodeSize: 93696
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2023:03:14 18:41:56+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Mar-2023 18:41:56

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 14-Mar-2023 18:41:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00016D2F
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rdata
0x00018000
0x00002956
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.data
0x0001B000
0x000005DC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.<!m
0x0001C000
0x00AED5F3
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.64D
0x00B0A000
0x0000036C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.74932
.zq'
0x00B0B000
0x00D58F60
0x00D59000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.98904
.rsrc
0x01864000
0x0004C62E
0x0004C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.81615

Imports

KERNEL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start setupfile.bin.exe no specs #RACCOON setupfile.bin.exe kcc2b9ze.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe" C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setupfile.bin.exe
c:\windows\system32\ntdll.dll
3348"C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe" C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setupfile.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3204"C:\Users\admin\AppData\Roaming\kCc2B9Ze.exe" C:\Users\admin\AppData\Roaming\kCc2B9Ze.exe—SetupFile.bin.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\kcc2b9ze.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
Total events
3 520
Read events
3 496
Write events
24
Delete events
0

Modification events

(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
18
Suspicious files
2
Text files
4
Unknown types
12

Dropped files

PID
Process
Filename
Type
3348SetupFile.bin.exeC:\Users\admin\AppData\Roaming\AOBxLIy9.exeexecutable
MD5:809FD08E5F79D466A9246B7A793F691D
SHA256:B532572F5B6417A242309C4A1BF5EEF3EAC6070626DF9DD5B23C89D81592E2D8
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\freebl3.dllexecutable
MD5:15B61E4A910C172B25FB7D8CCB92F754
SHA256:B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\JPVk4KEXd9umsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\Z38XqNY92X0Nsqlite
MD5:49E1E66E8EEFE2553D2ECEC4B7EF1D3E
SHA256:A664C359ACE3BFC149323E5403BB7140A84519043BDBA59B064EBC1BDADD32D4
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\53WnSLRx82Fosqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\m2c1hjTAU9fntext
MD5:16137445CEBCECA2926FE761FCDDF5B5
SHA256:186D99A8E7BC4C3DF1D05706836F19C42A53BECE231CF7F1256BE1F09079C7D5
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\nss3.dllexecutable
MD5:F67D08E8C02574CBC2F1122C53BFB976
SHA256:C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
SetupFile.bin.exe
GET
200
37.220.87.61:80
http://37.220.87.61/Clip1.exe
UZ
executable
6.78 Mb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
UZ
executable
1.95 Mb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
UZ
executable
668 Kb
malicious
3348
SetupFile.bin.exe
GET
200
77.73.134.35:80
http://77.73.134.35/bebra.exe
KZ
executable
13.8 Mb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
UZ
executable
438 Kb
malicious
3348
SetupFile.bin.exe
POST
200
37.220.87.68:80
http://37.220.87.68/
UZ
text
7.22 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
UZ
executable
78.2 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
UZ
executable
612 Kb
malicious
3348
SetupFile.bin.exe
POST
200
37.220.87.68:80
http://37.220.87.68/92c59de91efbcfd7a250221f78d5ff35
UZ
text
8 b
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
UZ
executable
1.05 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3348
SetupFile.bin.exe
37.220.87.68:80
—
LLC Internet Tehnologii
UZ
malicious
3348
SetupFile.bin.exe
37.220.87.61:80
—
LLC Internet Tehnologii
UZ
malicious
—
—
77.73.134.35:80
—
Partner LLC
KZ
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3348
SetupFile.bin.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin M1
3348
SetupFile.bin.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
3348
SetupFile.bin.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupFile.bin