Analysis
- max time kernel
19s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
5c8050e907434066c6857344215641a4.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5c8050e907434066c6857344215641a4.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 5c8050e907434066c6857344215641a4.exe
- Size 423KB
- Sample210824-tk1f2f4erj
- SHA256 2b18d06c8dcd5526c85b3adec55515b410b2c80ea586d26e02f3c238b93579b8
- MD5 5c8050e907434066c6857344215641a4
- SHA1 ef7baba758b95b0981acfdac7eb5277df0b8164a
- SHA512 13b8da7d3bec8c282116af1338ff306eed00dcc6fafc21cab985814f64848508622e6abcebbb74f676060f498f1f73098cc9489549b626dd540f3ab573ae6242
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2236 created 632 2236 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 2584 632 WerFault.exe 67 2652 632 WerFault.exe 67 936 632 WerFault.exe 67 2596 632 WerFault.exe 67 2236 632 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2584 WerFault.exe Token: SeBackupPrivilege 2584 WerFault.exe Token: SeDebugPrivilege 2584 WerFault.exe Token: SeDebugPrivilege 2652 WerFault.exe Token: SeDebugPrivilege 936 WerFault.exe Token: SeDebugPrivilege 2596 WerFault.exe Token: SeDebugPrivilege 2236 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c8050e907434066c6857344215641a4.exe"C:\Users\Admin\AppData\Local\Temp\5c8050e907434066c6857344215641a4.exe"1⤵PID:632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 9042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 9402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-