Analysis
- max time kernel
21s - max time network
131s - platform
windows10_x64 - resource
win10v20210408 - submitted
25/08/2021, 23:06
Static task
static1
Behavioral task
behavioral1
Sample
adedaf5e119be48cc90bf8b7851f9e5d.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
adedaf5e119be48cc90bf8b7851f9e5d.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target adedaf5e119be48cc90bf8b7851f9e5d.exe
- Size 456KB
- Sample210825-9e6vvlr3wn
- SHA256 8c6bfcef8131e02e228eb4e94537deb8c15f897eeaee0086f67e0bb6c45066f7
- MD5 adedaf5e119be48cc90bf8b7851f9e5d
- SHA1 08b30e6c30e66bfce82bd7e573f02b939a41bda0
- SHA512 82e2c5b23e5c857673bfbc0beb3afceb2ad11c5624f6daf2a256c98eebd3c4d288129f0f550b6b374908e955d9feee3edb0893307d7cdbfce8c378ebffce0d89
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
38e2f62d887d39c6db08d68fd47bd92cdb6c89d2
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2200 created 900 2200 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 2860 900 WerFault.exe 67 2624 900 WerFault.exe 67 192 900 WerFault.exe 67 2900 900 WerFault.exe 67 2200 900 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 2624 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2900 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2860 WerFault.exe Token: SeBackupPrivilege 2860 WerFault.exe Token: SeDebugPrivilege 2860 WerFault.exe Token: SeDebugPrivilege 2624 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 2900 WerFault.exe Token: SeDebugPrivilege 2200 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adedaf5e119be48cc90bf8b7851f9e5d.exe"C:\Users\Admin\AppData\Local\Temp\adedaf5e119be48cc90bf8b7851f9e5d.exe"1⤵PID:900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 9162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-