Analysis
- max time kernel
15s - max time network
119s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/08/2021, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
01ff144b49f948b06c93a24f6924afd9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
01ff144b49f948b06c93a24f6924afd9.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 01ff144b49f948b06c93a24f6924afd9.exe
- Size 429KB
- Sample210824-edb5fbq17j
- SHA256 106f44512e66537d4e5f1b0b08c561951882eb3bdf5e648cebb4c5a9a2ba3c8a
- MD5 01ff144b49f948b06c93a24f6924afd9
- SHA1 bb44f0dd41b0a971d0cc1c1b4069ce802f79e73d
- SHA512 3a37b3b38d56c1eedb25f510fff5192aacb3be5a99b439d254a3b6f15e6d016c2686c8c72d82aa383147f4d0dbbdb1bbf9f4464c2013f5ca47a67327e12c4286
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3740 created 3156 3740 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 3624 3156 WerFault.exe 68 2128 3156 WerFault.exe 68 3748 3156 WerFault.exe 68 3412 3156 WerFault.exe 68 3740 3156 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe 3740 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3624 WerFault.exe Token: SeBackupPrivilege 3624 WerFault.exe Token: SeDebugPrivilege 3624 WerFault.exe Token: SeDebugPrivilege 2128 WerFault.exe Token: SeDebugPrivilege 3748 WerFault.exe Token: SeDebugPrivilege 3412 WerFault.exe Token: SeDebugPrivilege 3740 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ff144b49f948b06c93a24f6924afd9.exe"C:\Users\Admin\AppData\Local\Temp\01ff144b49f948b06c93a24f6924afd9.exe"1⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740
-