analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

SetupVPN.zip

Full analysis: https://app.any.run/tasks/0d02d7e8-bb36-4287-b398-0f283cdd6709
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 12, 2022, 17:38:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E7DA2D3EE30FE5CDA0F5FCF6AE492EC4

SHA1:

306B475FB8A8874204E907FB50EBB02E6686149D

SHA256:

EED6B8957690CAED8153F3A7215BB19BC9AF0A956E2594B81E6288199DEB5F1B

SSDEEP:

196608:bD4/Chv5JHEe12s4qEUi5C2Vq0vO4Fyfg:b0kHx2s4qteCmPFyfg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3612)
      • Setup.exe (PID: 2356)
    • RACCOON was detected

      • Setup.exe (PID: 2356)
    • Drops executable file immediately after starts

      • Setup.exe (PID: 2356)
    • Connects to CnC server

      • Setup.exe (PID: 2356)
    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2356)
    • Stealing of credential data

      • Setup.exe (PID: 2356)
    • Steals credentials from Web Browsers

      • Setup.exe (PID: 2356)
  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3612)
      • Setup.exe (PID: 2356)
    • Checks supported languages

      • Setup.exe (PID: 2356)
      • WinRAR.exe (PID: 3612)
    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2356)
    • Drops a file with a compile date too recent

      • Setup.exe (PID: 2356)
    • Reads Environment values

      • Setup.exe (PID: 2356)
    • Searches for installed software

      • Setup.exe (PID: 2356)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • Setup.exe (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Setup.exe
ZipUncompressedSize: 761285504
ZipCompressedSize: 6842992
ZipCRC: 0x0c0534c6
ZipModifyDate: 2022:08:11 08:21:24
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs #RACCOON setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3612"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SetupVPN.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2748"C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exeWinRAR.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
FTemplateView
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3612.6854\setup.exe
c:\windows\system32\ntdll.dll
2356"C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe
WinRAR.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
FTemplateView
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3612.6854\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
Total events
2 332
Read events
2 294
Write events
38
Delete events
0

Modification events

(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3612) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SetupVPN.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
7
Suspicious files
1
Text files
5
Unknown types
6

Dropped files

PID
Process
Filename
Type
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe
MD5:
SHA256:
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\About Us\About Us.docxtext
MD5:0BF995C2674CC2E8D1FCA36B0B5CEA52
SHA256:1BC911066A3EA12218971AE45B931E55542DAADCB590980B7051BE86E53F59E4
2356Setup.exeC:\Users\admin\AppData\LocalLow\klc0B5Hlmgfnimage
MD5:DD2FB2E4B0AC145DBB3DDAB6FDB15960
SHA256:59DF48ECA1F252B0575D010D0925C84158C2D9CE43996C85C2A3609B6740FD12
2356Setup.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\About Us\Privacy Policy.docxtext
MD5:30E506BB5909B9BB15882D20CD2A6074
SHA256:A198B8E278B7BBCE7969E1461764DB2384C04456706F50A3F00C46384B036FC7
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Terms of Service\Terms Of Service.txttext
MD5:09058F4C0551DCCC07C7D416F6A7B2AC
SHA256:0C623AB6E936ADFCDA41E1BA51EA531CCCD007E946EADC196FA3047F80A0E672
2356Setup.exeC:\Users\admin\AppData\LocalLow\sqlite3.dllexecutable
MD5:DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA256:47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
2356Setup.exeC:\Users\admin\AppData\LocalLow\6XF65L1PxWBAtext
MD5:E7CE898AADD69F4E4280010B7808116E
SHA256:C9214BB54F10242AA254F0758372A440C8D8F49934021F8F08B6DF9FB377EB02
2356Setup.exeC:\Users\admin\AppData\LocalLow\EZZ7DnP5867asqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
2356Setup.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/
unknown
text
5.55 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
unknown
executable
1.05 Mb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
unknown
executable
78.2 Kb
malicious
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/6b4f8270f024dbe8c7e1cae9669c01f4
unknown
text
8 b
malicious
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/6b4f8270f024dbe8c7e1cae9669c01f4
unknown
text
8 b
malicious
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/6b4f8270f024dbe8c7e1cae9669c01f4
unknown
text
8 b
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
unknown
executable
248 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
unknown
executable
668 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
unknown
executable
438 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
unknown
executable
612 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
Setup.exe
185.234.247.68:80
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/Kryptik.HQAF Checkin
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info