Analysis
- max time kernel
21s - max time network
116s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
228a5335d126e6480fb3106fa04f3483.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
228a5335d126e6480fb3106fa04f3483.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 228a5335d126e6480fb3106fa04f3483.exe
- Size 480KB
- Sample210824-pmapdprkb6
- SHA256 6977a2df32c4fc8b2db35f556fda16abfd724e1c72df6a145589a2158374444a
- MD5 228a5335d126e6480fb3106fa04f3483
- SHA1 90356734444bf7bdeeadefb4c6d6f1b3779710f0
- SHA512 09405390394ccad4351903d5b7aac3c8fa2ee4a61b2a4277926d7c1e520ad4fd8bf98e2a128dee462839a000ec94a14fa0f271a687c44e7235e8e2920cf191aa
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
a1a43beaaa93b1df0d143d0f04579261c2872b99
Attributes
-
url4cnc
https://telete.in/xziNeoToad3
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 476 created 4796 476 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3060 4796 WerFault.exe 67 424 4796 WerFault.exe 67 804 4796 WerFault.exe 67 1000 4796 WerFault.exe 67 476 4796 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 3060 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 804 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe 476 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3060 WerFault.exe Token: SeBackupPrivilege 3060 WerFault.exe Token: SeDebugPrivilege 3060 WerFault.exe Token: SeDebugPrivilege 424 WerFault.exe Token: SeDebugPrivilege 804 WerFault.exe Token: SeDebugPrivilege 1000 WerFault.exe Token: SeDebugPrivilege 476 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\228a5335d126e6480fb3106fa04f3483.exe"C:\Users\Admin\AppData\Local\Temp\228a5335d126e6480fb3106fa04f3483.exe"1⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 9162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476
-