analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://telegra.ph/New-Soft-2023-02-14 |
| Full analysis: | https://app.any.run/tasks/ba32bf55-47c7-4855-9f14-458e0dad54c3 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 27, 2023 at 13:17:10 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 9F60CDBC7E3ED32069C03E623ECFCFCC |
| SHA1: | A5C6AEEC8F9919840AED89D7CA219C8783206F70 |
| SHA256: | F7E84962F7F4CE3BB34CA2E7DBDED736267E0D9A41A8029A82639BE522A2B370 |
| SSDEEP: | 3:N8IEukIVPn:2IEukIVP |
MALICIOUS
Connects to the CnC server
- Setup_x86_x64.exe (PID: 1456)
RACCOON was detected
- Setup_x86_x64.exe (PID: 1456)
Actions looks like stealing of personal data
- Setup_x86_x64.exe (PID: 1456)
- tIsoWuZq.exe (PID: 3052)
Steals credentials
- Setup_x86_x64.exe (PID: 1456)
RACCOON detected by memory dumps
- Setup_x86_x64.exe (PID: 1456)
Steals credentials from Web Browsers
- tIsoWuZq.exe (PID: 3052)
Application was dropped or rewritten from another process
- tIsoWuZq.exe (PID: 3052)
SUSPICIOUS
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- firefox.exe (PID: 2388)
Reads the Internet Settings
- Setup_x86_x64.exe (PID: 1456)
Executable content was dropped or overwritten
- Setup_x86_x64.exe (PID: 1456)
Searches for installed software
- Setup_x86_x64.exe (PID: 1456)
Reads browser cookies
- Setup_x86_x64.exe (PID: 1456)
Starts CMD.EXE for commands execution
- tIsoWuZq.exe (PID: 3052)
Connects to the server without a host name
- Setup_x86_x64.exe (PID: 1456)
Process requests binary or script from the Internet
- Setup_x86_x64.exe (PID: 1456)
INFO
Application launched itself
- firefox.exe (PID: 2388)
Executable content was dropped or overwritten
- firefox.exe (PID: 2388)
- WinRAR.exe (PID: 2648)
Create files in a temporary directory
- firefox.exe (PID: 2388)
The process uses the downloaded file
- firefox.exe (PID: 2388)
- WinRAR.exe (PID: 2648)
Reads the machine GUID from the registry
- Setup_x86_x64.exe (PID: 1456)
Checks supported languages
- Setup_x86_x64.exe (PID: 1456)
- tIsoWuZq.exe (PID: 3052)
Reads the computer name
- Setup_x86_x64.exe (PID: 1456)
- tIsoWuZq.exe (PID: 3052)
Checks proxy server information
- Setup_x86_x64.exe (PID: 1456)
The process checks LSA protection
- Setup_x86_x64.exe (PID: 1456)
Creates files or folders in the user directory
- Setup_x86_x64.exe (PID: 1456)
- tIsoWuZq.exe (PID: 3052)
Reads product name
- Setup_x86_x64.exe (PID: 1456)
Reads Environment values
- Setup_x86_x64.exe (PID: 1456)
Loads dropped or rewritten executable
- Setup_x86_x64.exe (PID: 1456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Raccoon
(PID) Process(1456) Setup_x86_x64.exe
C2 (1)http://94.142.138.246:80/
Keys
xor16f1f6f93845d7ef5cacfcd83865d888
Total processes
45
Monitored processes
11
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1456 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb2648.8563\AppSetup\Setup_x86_x64.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb2648.8563\AppSetup\Setup_x86_x64.exe | WinRAR.exe | ||||||||||||
User: admin Company: Nullsoft, Inc. Integrity Level: MEDIUM Description: winamp Exit code: 0 Version: 5.6.9.2 Modules
Raccoon(PID) Process(1456) Setup_x86_x64.exe C2 (1)http://94.142.138.246:80/ Keys xor16f1f6f93845d7ef5cacfcd83865d888 | |||||||||||||||
| 1596 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.0.36889297\1012182768" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 1188 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 2388 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://telegra.ph/New-Soft-2023-02-14" | C:\Program Files\Mozilla Firefox\firefox.exe | explorer.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 2596 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.27.196482141\716294052" -childID 4 -isForBrowser -prefsHandle 7600 -prefMapHandle 7552 -prefsLen 7103 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 7384 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 2616 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.13.648229925\1142204121" -childID 2 -isForBrowser -prefsHandle 2596 -prefMapHandle 2612 -prefsLen 5823 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 2628 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 2636 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.20.1792838514\301959284" -childID 3 -isForBrowser -prefsHandle 3440 -prefMapHandle 3084 -prefsLen 6545 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 3080 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 2648 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AppSetup.rar" | C:\Program Files\WinRAR\WinRAR.exe | firefox.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2656 | C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\admin\AppData\Roaming\tIsoWuZq.exe | C:\Windows\System32\cmd.exe | — | tIsoWuZq.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2724 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.3.20997476\1211886323" -childID 1 -isForBrowser -prefsHandle 1344 -prefMapHandle 1680 -prefsLen 1 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 1368 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 67.0.4 Modules
| |||||||||||||||
| 3024 | choice /C Y /N /D Y /T 0 | C:\Windows\System32\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Offers the user a choice Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
8 531
Read events
8 492
Write events
39
Delete events
0
Modification events
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 0000000000000000 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2388) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2648) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2648) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2648) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7AndW2K8R2-KB3191566-x64.zip | |||
Executable files
23
Suspicious files
451
Text files
2 250
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2388 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\urlCache-current.bin | binary | |
MD5:6BED2A248268034CA1F73B2925365DE2 | SHA256:A45996AA907815E86366A17ED448F75A584D7B600AA9398E14DE21DFAD3D613A | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:2B6B5ABCA010270C502C5DD277CD9E7A | SHA256:99DF8717921F70577FCE3386BB7962A804E490C7157F764458001843A1EC606C | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\permissions.sqlite-journal | binary | |
MD5:FEB357804CFF40D386AF01826CD99319 | SHA256:A27C7536953FD3F9EB7322E26AD4CAED84296E84B10C2B4996672FF8267302F2 | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\prefs-1.js | text | |
MD5:4EC974EEAB3AA07E555816C57A0C7B52 | SHA256:113F3FB79C998EFE7CCF768A351E2898BD20584A5747394AE0380A8501928486 | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\prefs.js | text | |
MD5:4EC974EEAB3AA07E555816C57A0C7B52 | SHA256:113F3FB79C998EFE7CCF768A351E2898BD20584A5747394AE0380A8501928486 | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 2388 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
98
TCP/UDP connections
207
DNS requests
456
Threats
35
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2388 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | text | 8 b | whitelisted |
2388 | firefox.exe | POST | 200 | 192.124.249.24:80 | http://ocsp.godaddy.com/ | US | binary | 1.74 Kb | whitelisted |
— | — | POST | — | 192.124.249.24:80 | http://ocsp.godaddy.com/ | US | — | — | whitelisted |
2388 | firefox.exe | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | binary | 471 b | whitelisted |
2388 | firefox.exe | POST | 200 | 142.250.184.227:80 | http://ocsp.pki.goog/gts1c3 | US | binary | 471 b | whitelisted |
2388 | firefox.exe | POST | 200 | 142.250.184.227:80 | http://ocsp.pki.goog/gts1c3 | US | binary | 471 b | whitelisted |
2388 | firefox.exe | POST | 200 | 2.16.186.35:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | shared |
2388 | firefox.exe | POST | 200 | 142.250.184.227:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
2388 | firefox.exe | POST | 200 | 108.138.47.59:80 | http://ocsp.r2m02.amazontrust.com/ | US | binary | 471 b | whitelisted |
2388 | firefox.exe | POST | 200 | 142.250.184.227:80 | http://ocsp.pki.goog/gts1c3 | US | binary | 472 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2388 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
328 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2388 | firefox.exe | 34.160.46.54:443 | search.services.mozilla.com | GOOGLE | US | suspicious |
2388 | firefox.exe | 2.16.186.35:80 | r3.o.lencr.org | Akamai International B.V. | DE | whitelisted |
2388 | firefox.exe | 52.84.195.35:443 | snippets.cdn.mozilla.net | AMAZON-02 | US | unknown |
2388 | firefox.exe | 34.117.65.55:443 | push.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
2388 | firefox.exe | 192.124.249.24:80 | ocsp.godaddy.com | SUCURI-SEC | US | suspicious |
2388 | firefox.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2388 | firefox.exe | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | GOOGLE-CLOUD-PLATFORM | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
telegra.ph |
| malicious |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
r3.o.lencr.org |
| shared |
a1887.dscq.akamai.net |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
ocsp.godaddy.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com) |
— | — | Potentially Bad Traffic | ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com) |
3 ETPRO signatures available at the full report