Analysis
- max time kernel
20s - max time network
115s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/08/2021, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
93532ec910e766b6cca04ab05eb4efab.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
93532ec910e766b6cca04ab05eb4efab.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 93532ec910e766b6cca04ab05eb4efab.exe
- Size 456KB
- Sample210826-bl937akyme
- SHA256 21f678e40a509402875f2fc2d8701fab4d45580cf698f0848bddaa81cbcf47d8
- MD5 93532ec910e766b6cca04ab05eb4efab
- SHA1 d9044c7053df4533d59ba44ebb02507ed42baa31
- SHA512 54ad24562b4a3859ecfeb05b3c9d12efb7f39c984787c019ff59ec4650db8cb0815de323b789488b7b33d0b3de1c91302601fdda623c7622f52b20cf50bb44d0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
38e2f62d887d39c6db08d68fd47bd92cdb6c89d2
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3308 created 528 3308 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 232 528 WerFault.exe 67 1292 528 WerFault.exe 67 2312 528 WerFault.exe 67 2656 528 WerFault.exe 67 3308 528 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 232 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 1292 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 232 WerFault.exe Token: SeBackupPrivilege 232 WerFault.exe Token: SeDebugPrivilege 232 WerFault.exe Token: SeDebugPrivilege 1292 WerFault.exe Token: SeDebugPrivilege 2312 WerFault.exe Token: SeDebugPrivilege 2656 WerFault.exe Token: SeDebugPrivilege 3308 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93532ec910e766b6cca04ab05eb4efab.exe"C:\Users\Admin\AppData\Local\Temp\93532ec910e766b6cca04ab05eb4efab.exe"1⤵PID:528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308
-