Analysis
- max time kernel
20s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
18af8e4f317e4d9ffe97d1c2806f4b03.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
18af8e4f317e4d9ffe97d1c2806f4b03.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 18af8e4f317e4d9ffe97d1c2806f4b03.exe
- Size 423KB
- Sample210824-71nfdknj2n
- SHA256 8bbb2744b45feea5115cf0da55e4bdd4eec08b4bb64992e41aca8aef68304b43
- MD5 18af8e4f317e4d9ffe97d1c2806f4b03
- SHA1 8f03bb44b0faabc2fa5f176d46c50d176f90645a
- SHA512 49342e31a54c395f1a2898d90f3d84fcc8efe9dc1720fdaa9879c1e4485fc2f075b45506ccde87d03d00c7591fcb04c22a2a27dc95154b3274cb18c99a4a4b21
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 788 created 804 788 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3396 804 WerFault.exe 67 1984 804 WerFault.exe 67 3568 804 WerFault.exe 67 1544 804 WerFault.exe 67 788 804 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3396 WerFault.exe Token: SeBackupPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 1984 WerFault.exe Token: SeDebugPrivilege 3568 WerFault.exe Token: SeDebugPrivilege 1544 WerFault.exe Token: SeDebugPrivilege 788 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18af8e4f317e4d9ffe97d1c2806f4b03.exe"C:\Users\Admin\AppData\Local\Temp\18af8e4f317e4d9ffe97d1c2806f4b03.exe"1⤵PID:804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788
-