Analysis
- max time kernel
16s - max time network
113s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/05/2021, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
5.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 5.exe
- Size 604KB
- Sample210506-hzzrm59a4x
- SHA256 624b7ae8befcf91dbf768d9703147ac8f9bd46b08ffe14a75c77e88736bf07d0
- MD5 a3f51e0d8c86e66c1e67d2ace44e5e3f
- SHA1 571ffa0cb9e23d918595789805f883eb325a9633
- SHA512 26aad7da410d1b8d0ef1eb3807f352433cbe8168aff46a74245040d97b4c971b2d4efe87d3729bae5980da716cbf10ad844b6e843260f522236b6c03c60f9101
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
1d76a465540f6a904ac9f1310fe3a3824b5b4549
Attributes
-
url4cnc
https://tttttt.me/kokajakprozak
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1524 created 2840 1524 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 204 2840 WerFault.exe 67 2260 2840 WerFault.exe 67 3316 2840 WerFault.exe 67 3936 2840 WerFault.exe 67 1524 2840 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3316 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 1524 WerFault.exe 1524 WerFault.exe 1524 WerFault.exe 1524 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 204 WerFault.exe Token: SeBackupPrivilege 204 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe Token: SeDebugPrivilege 2260 WerFault.exe Token: SeDebugPrivilege 3316 WerFault.exe Token: SeDebugPrivilege 3936 WerFault.exe Token: SeDebugPrivilege 1524 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"1⤵PID:2840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 9282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 8802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
-