Analysis
- max time kernel
19s - max time network
82s - platform
windows10_x64 - resource
win10v20210408 - submitted
14/08/2021, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
6ac97f2adaad0b92fa522d9bef189ae4.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6ac97f2adaad0b92fa522d9bef189ae4.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 6ac97f2adaad0b92fa522d9bef189ae4.exe
- Size 469KB
- Sample210814-g2tmfh2f4x
- SHA256 2d54e0a38b0f02e204233f6a842d765fc7efb0e72f35302493e60bcdfd841a17
- MD5 6ac97f2adaad0b92fa522d9bef189ae4
- SHA1 5867a7137b4346ab95587fb84d2076411675a438
- SHA512 18bb7db75a4cfdf562fe06e8cae7d11cbcb076bf38200d3e7cdc21020332363d96125ea733ea7c9e25f06c83d0df5565833b3098e0d655fc225b867ecd3e82fa
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
93d3ccba4a3cbd5e268873fc1760b2335272e198
Attributes
-
url4cnc
https://telete.in/opa4kiprivatem
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2236 created 656 2236 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3780 656 WerFault.exe 67 2820 656 WerFault.exe 67 184 656 WerFault.exe 67 200 656 WerFault.exe 67 2236 656 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3780 WerFault.exe Token: SeBackupPrivilege 3780 WerFault.exe Token: SeDebugPrivilege 3780 WerFault.exe Token: SeDebugPrivilege 2820 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 2236 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac97f2adaad0b92fa522d9bef189ae4.exe"C:\Users\Admin\AppData\Local\Temp\6ac97f2adaad0b92fa522d9bef189ae4.exe"1⤵PID:656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 9042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-