File name:

SetupFile.bin

Full analysis: https://app.any.run/tasks/6932fea4-7b5c-4002-828e-4c15c6c8f6e1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 31, 2023, 23:27:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
raccoon
recordbreaker
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B66BAD3F04BCB6C019F8675E12445492

SHA1:

80D448D75A2209CA3FB0C9C99262BABB49EE5D8E

SHA256:

78C47BCEC66944351AD26FBB22565CCA7268099A47250518B0D51A43F677C236

SSDEEP:

196608:NYzLzScvgh3AADZ7sMHEXBhb8Jrznl32LUTxqLrkSdNMjGYQcH7WTyCWxxPajesR:mjScvgh3A4dLHEx0rILKxC3+bGy96ey

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RACCOON was detected

      • SetupFile.bin.exe (PID: 3348)

    • Connects to the CnC server

      • SetupFile.bin.exe (PID: 3348)

    • Application was dropped or rewritten from another process

      • kCc2B9Ze.exe (PID: 3204)

    • Actions looks like stealing of personal data

      • SetupFile.bin.exe (PID: 3348)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SetupFile.bin.exe (PID: 3348)

    • Searches for installed software

      • SetupFile.bin.exe (PID: 3348)

    • Executable content was dropped or overwritten

      • SetupFile.bin.exe (PID: 3348)

    • Process requests binary or script from the Internet

      • SetupFile.bin.exe (PID: 3348)

    • Connects to the server without a host name

      • SetupFile.bin.exe (PID: 3348)

    • Reads browser cookies

      • SetupFile.bin.exe (PID: 3348)

  • INFO

    • Checks supported languages

      • SetupFile.bin.exe (PID: 3348)
      • kCc2B9Ze.exe (PID: 3204)

    • Reads the computer name

      • SetupFile.bin.exe (PID: 3348)

    • Reads the machine GUID from the registry

      • SetupFile.bin.exe (PID: 3348)

    • Checks proxy server information

      • SetupFile.bin.exe (PID: 3348)

    • The process checks LSA protection

      • SetupFile.bin.exe (PID: 3348)

    • Reads Environment values

      • SetupFile.bin.exe (PID: 3348)

    • Reads product name

      • SetupFile.bin.exe (PID: 3348)

    • Creates files or folders in the user directory

      • SetupFile.bin.exe (PID: 3348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x17b43cf
UninitializedDataSize: -
InitializedDataSize: 325632
CodeSize: 93696
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2023:03:14 18:41:56+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Mar-2023 18:41:56

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 14-Mar-2023 18:41:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00016D2F
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rdata
0x00018000
0x00002956
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.data
0x0001B000
0x000005DC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.<!m
0x0001C000
0x00AED5F3
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.64D
0x00B0A000
0x0000036C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.74932
.zq'
0x00B0B000
0x00D58F60
0x00D59000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.98904
.rsrc
0x01864000
0x0004C62E
0x0004C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.81615

Imports

KERNEL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start #RACCOON setupfile.bin.exe kcc2b9ze.exe no specs setupfile.bin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe" C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setupfile.bin.exe
c:\windows\system32\ntdll.dll
3204"C:\Users\admin\AppData\Roaming\kCc2B9Ze.exe" C:\Users\admin\AppData\Roaming\kCc2B9Ze.exe—SetupFile.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\kcc2b9ze.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
3348"C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe" C:\Users\admin\AppData\Local\Temp\SetupFile.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setupfile.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 520
Read events
3 496
Write events
24
Delete events
0

Modification events

(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3348) SetupFile.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
18
Suspicious files
2
Text files
4
Unknown types
12

Dropped files

PID
Process
Filename
Type
3348SetupFile.bin.exeC:\Users\admin\AppData\Roaming\AOBxLIy9.exeexecutable
MD5:—
SHA256:—
3348SetupFile.bin.exeC:\Users\admin\AppData\Roaming\kCc2B9Ze.exeexecutable
MD5:—
SHA256:—
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\c4gFB7xOBe6Csqlite
MD5:D02907BE1C995E1E51571EEDB82FA281
SHA256:2189977F6EA58BDAD5883720B099E12B869F223FB9B18AC40E7D37C5954A55DD
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\sqlite3.dllexecutable
MD5:DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA256:47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\wqXXAU16aNkrsqlite
MD5:D02907BE1C995E1E51571EEDB82FA281
SHA256:2189977F6EA58BDAD5883720B099E12B869F223FB9B18AC40E7D37C5954A55DD
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\cjJGk6NJ47RVtext
MD5:E7CE898AADD69F4E4280010B7808116E
SHA256:C9214BB54F10242AA254F0758372A440C8D8F49934021F8F08B6DF9FB377EB02
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\JPVk4KEXd9umsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
3348SetupFile.bin.exeC:\Users\admin\AppData\LocalLow\JPVk4KEXd9um-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
3
DNS requests
0
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
UZ
executable
438 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
UZ
executable
78.2 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
UZ
executable
612 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
UZ
executable
668 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
UZ
executable
248 Kb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
UZ
executable
1.05 Mb
malicious
3348
SetupFile.bin.exe
GET
200
37.220.87.68:80
http://37.220.87.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
UZ
executable
1.95 Mb
malicious
3348
SetupFile.bin.exe
POST
200
37.220.87.68:80
http://37.220.87.68/
UZ
text
7.22 Kb
malicious
3348
SetupFile.bin.exe
POST
200
37.220.87.68:80
http://37.220.87.68/92c59de91efbcfd7a250221f78d5ff35
UZ
text
8 b
malicious
3348
SetupFile.bin.exe
POST
200
37.220.87.68:80
http://37.220.87.68/92c59de91efbcfd7a250221f78d5ff35
UZ
text
8 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3348
SetupFile.bin.exe
37.220.87.68:80
—
LLC Internet Tehnologii
UZ
malicious
3348
SetupFile.bin.exe
37.220.87.61:80
—
LLC Internet Tehnologii
UZ
malicious
—
—
77.73.134.35:80
—
Partner LLC
KZ
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3348
SetupFile.bin.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin M1
3348
SetupFile.bin.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
3348
SetupFile.bin.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
3348
SetupFile.bin.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3348
SetupFile.bin.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupFile.bin