Analysis
- max time kernel
11s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/08/2021, 22:12
Static task
static1
Behavioral task
behavioral1
Sample
2E12BC090CE21EA509D21BD48757509EE0FD145DFEF15.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 2E12BC090CE21EA509D21BD48757509EE0FD145DFEF15.exe
- Size 605KB
- Sample210813-vdjmfl4kna
- SHA256 2e12bc090ce21ea509d21bd48757509ee0fd145dfef1527b01d7b037e37295fd
- MD5 65d583d0b51e30c81da1aacb16e6f84e
- SHA1 feeecd4df80de226683f5cf1b07866a4eb3b64ff
- SHA512 aa841aac18d86d05b79c5c68e2be24e5812d134241ff35956d87cd914e502af313b10fcab368b758b030155e43c7f337f08900d83eeebb66e664dc58b9d8f352
- MD5 SHA1 SHA512
Malware Config
Signatures
- Raccoon Stealer Payload 2 IoCs
resource yara_rule behavioral2/memory/744-114-0x0000000002110000-0x00000000021A1000-memory.dmp family_raccoon behavioral2/memory/744-115-0x0000000000400000-0x00000000004AC000-memory.dmp family_raccoon - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3268 created 744 3268 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 4060 744 WerFault.exe 68 3548 744 WerFault.exe 68 3356 744 WerFault.exe 68 684 744 WerFault.exe 68 3268 744 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 684 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4060 WerFault.exe Token: SeBackupPrivilege 4060 WerFault.exe Token: SeDebugPrivilege 4060 WerFault.exe Token: SeDebugPrivilege 3548 WerFault.exe Token: SeDebugPrivilege 3356 WerFault.exe Token: SeDebugPrivilege 684 WerFault.exe Token: SeDebugPrivilege 3268 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2E12BC090CE21EA509D21BD48757509EE0FD145DFEF15.exe"C:\Users\Admin\AppData\Local\Temp\2E12BC090CE21EA509D21BD48757509EE0FD145DFEF15.exe"1⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 7082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 8962⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-