Analysis
-
max time kernel
97s -
max time network
98s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 19:12
Static task
static1
Behavioral task
behavioral1
Sample
CHEAT.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CHEAT.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
CHEAT.exe
-
Size
560KB
-
MD5
d93f322e915785edd46779a708e4f6d1
-
SHA1
778331a71313b0108d4fbbfa93304a441fc36c87
-
SHA256
59adfc0c805869287af49100c2ea65a80e6ebbaaf256f5e40d488b5dad38ee65
-
SHA512
b63fd4c5dcd3df8a17307ac55d302365f383d3834f469441ce586f92cbf0813b90ae85d8e0c4a0e78bbf3465943f3562958fc6618eeb4514ad3bd5c20d240fc9
Malware Config
Extracted
Family
raccoon
Botnet
392ed1d1c41045fcab62229aa831efc30cb93f05
Attributes
-
url4cnc
https://telete.in/jomrblack
rc4.plain
rc4.plain
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2180 created 1212 2180 WerFault.exe CHEAT.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3812 1212 WerFault.exe CHEAT.exe 360 1212 WerFault.exe CHEAT.exe 200 1212 WerFault.exe CHEAT.exe 732 1212 WerFault.exe CHEAT.exe 2180 1212 WerFault.exe CHEAT.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 360 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 732 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3812 WerFault.exe Token: SeBackupPrivilege 3812 WerFault.exe Token: SeDebugPrivilege 3812 WerFault.exe Token: SeDebugPrivilege 360 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 732 WerFault.exe Token: SeDebugPrivilege 2180 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHEAT.exe"C:\Users\Admin\AppData\Local\Temp\CHEAT.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-11-0x0000000004160000-0x0000000004161000-memory.dmpFilesize
4KB
-
memory/360-8-0x0000000004480000-0x0000000004481000-memory.dmpFilesize
4KB
-
memory/732-14-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/1212-2-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/1212-4-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB
-
memory/1212-3-0x0000000000A10000-0x0000000000AA2000-memory.dmpFilesize
584KB
-
memory/2180-17-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/3812-5-0x0000000004420000-0x0000000004421000-memory.dmpFilesize
4KB
-
memory/3812-6-0x0000000004420000-0x0000000004421000-memory.dmpFilesize
4KB