Analysis
-
max time kernel
13s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-02-2021 06:48
Static task
static1
Behavioral task
behavioral1
Sample
5efc99d9f6a8e501f7196aac0c8f82c5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5efc99d9f6a8e501f7196aac0c8f82c5.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
5efc99d9f6a8e501f7196aac0c8f82c5.exe
-
Size
555KB
-
MD5
5efc99d9f6a8e501f7196aac0c8f82c5
-
SHA1
61565efdd1d8300d91795fd514219c6f92a1ef3e
-
SHA256
48543c618981b229afd8f50a0cc5581e4325d098b1fc95c3074609d31e5e86a3
-
SHA512
f43d2b1b397a18c249ab83fbe944ba6e0421497ed3a3cb3247b10ba0ef663674902713fa6a55e6c5662f171d25cc91262bb99c004f669bb6e59b10006f2e1d93
Malware Config
Extracted
Family
raccoon
Botnet
a3a85b69314053c3bb015532d1a960a3d08baeb8
Attributes
-
url4cnc
https://telete.in/baudemars
rc4.plain
rc4.plain
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4272 created 4764 4272 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3508 4764 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe 3244 4764 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe 3116 4764 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe 4224 4764 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe 4272 4764 WerFault.exe 5efc99d9f6a8e501f7196aac0c8f82c5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3508 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3244 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3508 WerFault.exe Token: SeBackupPrivilege 3508 WerFault.exe Token: SeDebugPrivilege 3508 WerFault.exe Token: SeDebugPrivilege 3244 WerFault.exe Token: SeDebugPrivilege 3116 WerFault.exe Token: SeDebugPrivilege 4224 WerFault.exe Token: SeDebugPrivilege 4272 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5efc99d9f6a8e501f7196aac0c8f82c5.exe"C:\Users\Admin\AppData\Local\Temp\5efc99d9f6a8e501f7196aac0c8f82c5.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 8322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 8602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-11-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/3244-8-0x0000000004620000-0x0000000004621000-memory.dmpFilesize
4KB
-
memory/3508-5-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/3508-6-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/4224-14-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/4272-17-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4764-2-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/4764-4-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB
-
memory/4764-3-0x0000000000960000-0x00000000009F2000-memory.dmpFilesize
584KB