Analysis
- max time kernel
22s - max time network
136s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
cbbac2273a64f48a8d804df3b591b4bb.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cbbac2273a64f48a8d804df3b591b4bb.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target cbbac2273a64f48a8d804df3b591b4bb.exe
- Size 429KB
- Sample210824-656l7pg5ea
- SHA256 70a7ea01f9b72bce12827971f0208c90d631535ba2d96286a67cacf6e62a13cf
- MD5 cbbac2273a64f48a8d804df3b591b4bb
- SHA1 4eb56ea5d2667ca37bb94439d6a9e38c0468b702
- SHA512 39395ce56bba5483d5295f13963a817d9cdb7e34ef2e73733053ad1ddf281e36ec528902e1c4819eaacbcf3ad50d2b74d5399c246e795043b848aa29a70d3fe8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 504 created 396 504 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3396 396 WerFault.exe 67 1316 396 WerFault.exe 67 1184 396 WerFault.exe 67 772 396 WerFault.exe 67 504 396 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3396 WerFault.exe Token: SeBackupPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 1316 WerFault.exe Token: SeDebugPrivilege 1184 WerFault.exe Token: SeDebugPrivilege 772 WerFault.exe Token: SeDebugPrivilege 504 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbbac2273a64f48a8d804df3b591b4bb.exe"C:\Users\Admin\AppData\Local\Temp\cbbac2273a64f48a8d804df3b591b4bb.exe"1⤵PID:396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 8682⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:504
-