Analysis
- max time kernel
15s - max time network
114s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/08/2021, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
66ea50d6eabf8c7e36e5b73344d3a19e.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
66ea50d6eabf8c7e36e5b73344d3a19e.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 66ea50d6eabf8c7e36e5b73344d3a19e.exe
- Size 429KB
- Sample210824-b65gd91q12
- SHA256 97298d62b017d407648414455e98ecc371aa405c5dd9071371fe0ae76ce4e847
- MD5 66ea50d6eabf8c7e36e5b73344d3a19e
- SHA1 d9fecfe34cc83580c09bdb0922f8f7cf8194213f
- SHA512 08d356b7be94fb5df4b3745d0855b10d1dbb9993f4ae8cc792f17d2e78f709b1f93f1a9bb642ba22f3dbe86e400da85568238686551f657c333a207e49f89864
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4004 created 4440 4004 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 3476 4440 WerFault.exe 68 2112 4440 WerFault.exe 68 4128 4440 WerFault.exe 68 4132 4440 WerFault.exe 68 4004 4440 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4128 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3476 WerFault.exe Token: SeBackupPrivilege 3476 WerFault.exe Token: SeDebugPrivilege 3476 WerFault.exe Token: SeDebugPrivilege 2112 WerFault.exe Token: SeDebugPrivilege 4128 WerFault.exe Token: SeDebugPrivilege 4132 WerFault.exe Token: SeDebugPrivilege 4004 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66ea50d6eabf8c7e36e5b73344d3a19e.exe"C:\Users\Admin\AppData\Local\Temp\66ea50d6eabf8c7e36e5b73344d3a19e.exe"1⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 8882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-