Analysis
- max time kernel
18s - max time network
123s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/08/2021, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
a9df5b777dcd667fe9172c51e80152cc.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9df5b777dcd667fe9172c51e80152cc.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target a9df5b777dcd667fe9172c51e80152cc.exe
- Size 455KB
- Sample210826-77e8jqtk2x
- SHA256 1a4b53bc5c7bee277bbdf259298086afbdbaf149e51811a72b8b159ba9b1c115
- MD5 a9df5b777dcd667fe9172c51e80152cc
- SHA1 8763613ad6ae9e2b903b5502e1b7bd02eb3befaf
- SHA512 b30b2fcebe1db1786745a6a9b7095e61355f905ef8d0964df62252468c315a9c9761c5f9320ab071f3d5407d11992e542deef855a5b3454ba8c68164b562ec36
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
827b865e42181ecfba26ffee236fbb0800626be1
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1572 created 636 1572 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 2660 636 WerFault.exe 67 3000 636 WerFault.exe 67 944 636 WerFault.exe 67 2196 636 WerFault.exe 67 1572 636 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe 1572 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2660 WerFault.exe Token: SeBackupPrivilege 2660 WerFault.exe Token: SeDebugPrivilege 2660 WerFault.exe Token: SeDebugPrivilege 3000 WerFault.exe Token: SeDebugPrivilege 944 WerFault.exe Token: SeDebugPrivilege 2196 WerFault.exe Token: SeDebugPrivilege 1572 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9df5b777dcd667fe9172c51e80152cc.exe"C:\Users\Admin\AppData\Local\Temp\a9df5b777dcd667fe9172c51e80152cc.exe"1⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8322⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-