Analysis
- max time kernel
18s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
22969623be1f678d39ab1df708469407.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
22969623be1f678d39ab1df708469407.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 22969623be1f678d39ab1df708469407.exe
- Size 429KB
- Sample210824-5fr42edk16
- SHA256 67c798fa66f431640bbe46c525ac2de543a2c2e7b6cc59e5967d8bc5d37b01cb
- MD5 22969623be1f678d39ab1df708469407
- SHA1 fe7aaf6f961e693880721dd05dfdff8fb2e0fa59
- SHA512 da6f172acd72f6f858d457c00e4003ecb0bd155a54fc67acb8e419d30107b863733364d9c191228b8c202158d3c3ea087e89aee991477c0a864d6e2a9d1e0b0d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2616 created 804 2616 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3452 804 WerFault.exe 67 3344 804 WerFault.exe 67 2036 804 WerFault.exe 67 3568 804 WerFault.exe 67 2616 804 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3452 WerFault.exe Token: SeBackupPrivilege 3452 WerFault.exe Token: SeDebugPrivilege 3452 WerFault.exe Token: SeDebugPrivilege 3344 WerFault.exe Token: SeDebugPrivilege 2036 WerFault.exe Token: SeDebugPrivilege 3568 WerFault.exe Token: SeDebugPrivilege 2616 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22969623be1f678d39ab1df708469407.exe"C:\Users\Admin\AppData\Local\Temp\22969623be1f678d39ab1df708469407.exe"1⤵PID:804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7242⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-