download:

SetupVPN.zip

Full analysis: https://app.any.run/tasks/0d02d7e8-bb36-4287-b398-0f283cdd6709
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 12, 2022, 17:38:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E7DA2D3EE30FE5CDA0F5FCF6AE492EC4

SHA1:

306B475FB8A8874204E907FB50EBB02E6686149D

SHA256:

EED6B8957690CAED8153F3A7215BB19BC9AF0A956E2594B81E6288199DEB5F1B

SSDEEP:

196608:bD4/Chv5JHEe12s4qEUi5C2Vq0vO4Fyfg:b0kHx2s4qteCmPFyfg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • RACCOON was detected

      • Setup.exe (PID: 2356)
    • Connects to CnC server

      • Setup.exe (PID: 2356)
    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3612)
      • Setup.exe (PID: 2356)
    • Drops executable file immediately after starts

      • Setup.exe (PID: 2356)
    • Steals credentials from Web Browsers

      • Setup.exe (PID: 2356)
    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2356)
    • Stealing of credential data

      • Setup.exe (PID: 2356)
  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3612)
      • Setup.exe (PID: 2356)
    • Checks supported languages

      • WinRAR.exe (PID: 3612)
      • Setup.exe (PID: 2356)
    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2356)
    • Drops a file with a compile date too recent

      • Setup.exe (PID: 2356)
    • Reads Environment values

      • Setup.exe (PID: 2356)
    • Searches for installed software

      • Setup.exe (PID: 2356)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • Setup.exe (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Setup.exe
ZipUncompressedSize: 761285504
ZipCompressedSize: 6842992
ZipCRC: 0x0c0534c6
ZipModifyDate: 2022:08:11 08:21:24
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs #RACCOON setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2356"C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe
WinRAR.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
FTemplateView
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3612.6854\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2748"C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exeWinRAR.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
FTemplateView
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3612.6854\setup.exe
c:\windows\system32\ntdll.dll
3612"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SetupVPN.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 332
Read events
2 294
Write events
38
Delete events
0

Modification events

(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3612) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SetupVPN.zip
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3612) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
7
Suspicious files
1
Text files
5
Unknown types
6

Dropped files

PID
Process
Filename
Type
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Setup.exe
MD5:
SHA256:
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\Terms of Service\Terms Of Service.txttext
MD5:
SHA256:
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\About Us\About Us.docxtext
MD5:
SHA256:
3612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3612.6854\About Us\Privacy Policy.docxtext
MD5:
SHA256:
2356Setup.exeC:\Users\admin\AppData\LocalLow\freebl3.dllexecutable
MD5:15B61E4A910C172B25FB7D8CCB92F754
SHA256:B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
2356Setup.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
2356Setup.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
2356Setup.exeC:\Users\admin\AppData\LocalLow\klc0B5Hlmgfnimage
MD5:
SHA256:
2356Setup.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
2356Setup.exeC:\Users\admin\AppData\LocalLow\Fj9drWk8bFMMsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
2
DNS requests
0
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/
unknown
text
5.55 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
unknown
executable
438 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
unknown
executable
78.2 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
unknown
executable
248 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
unknown
executable
668 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
unknown
executable
612 Kb
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
unknown
executable
1.05 Mb
malicious
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/6b4f8270f024dbe8c7e1cae9669c01f4
unknown
text
8 b
malicious
2356
Setup.exe
POST
200
185.234.247.68:80
http://185.234.247.68/6b4f8270f024dbe8c7e1cae9669c01f4
unknown
text
8 b
malicious
2356
Setup.exe
GET
200
185.234.247.68:80
http://185.234.247.68/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
unknown
executable
1.95 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
Setup.exe
185.234.247.68:80
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/Kryptik.HQAF Checkin
2356
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2356
Setup.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info