Analysis
- max time kernel
15s - max time network
114s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/08/2021, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
AE184334F95325BC0A52E10B74C0C755.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AE184334F95325BC0A52E10B74C0C755.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target AE184334F95325BC0A52E10B74C0C755.exe
- Size 428KB
- Sample210824-raxj95aflx
- SHA256 ea435f8deba53b4fd4a17dfd99f6d41ec709667aa0c79fd2ba8d5e896e93a0e3
- MD5 ae184334f95325bc0a52e10b74c0c755
- SHA1 09adce223485b4963ba31ee0733b764e9d1a51be
- SHA512 3e1531414836f3ab371651dd53b07e85a52a3f54c47ddaa58206d6e51c9ccd574cbce4efd9369868050b8e0a96f7923571eef54dc88813d551b8e3c09131684b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
00bdd6858c3856861f0d81937643f61ec7429443
Attributes
-
url4cnc
https://telete.in/forkmaster123
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3268 created 3156 3268 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 188 3156 WerFault.exe 68 316 3156 WerFault.exe 68 660 3156 WerFault.exe 68 1920 3156 WerFault.exe 68 3268 3156 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 1920 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 188 WerFault.exe Token: SeBackupPrivilege 188 WerFault.exe Token: SeDebugPrivilege 188 WerFault.exe Token: SeDebugPrivilege 316 WerFault.exe Token: SeDebugPrivilege 660 WerFault.exe Token: SeDebugPrivilege 1920 WerFault.exe Token: SeDebugPrivilege 3268 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AE184334F95325BC0A52E10B74C0C755.exe"C:\Users\Admin\AppData\Local\Temp\AE184334F95325BC0A52E10B74C0C755.exe"1⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 6802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8842⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-