Analysis
- max time kernel
22s - max time network
136s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/08/2021, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
bfe052c5f5995d1940da5d2cb6a67f10.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bfe052c5f5995d1940da5d2cb6a67f10.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target bfe052c5f5995d1940da5d2cb6a67f10.exe
- Size 456KB
- Sample210826-e2qtnk15as
- SHA256 1abe05a6b66d10bebcfc20d1ff0618c90343217c60e32d46a1fc662a28bb0f74
- MD5 bfe052c5f5995d1940da5d2cb6a67f10
- SHA1 90d9ef117b43dd7ded2fd01c28b5c3b528b756ae
- SHA512 36cfa1962a552426dd4115ebae0102da519052d9cf0736a686a9cfbf9ad25c8c4381ab77465d093369e9f6f263660ccb561f1ad655b3a203de22cb4754b8b58a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 504 created 416 504 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 676 416 WerFault.exe 67 204 416 WerFault.exe 67 2300 416 WerFault.exe 67 548 416 WerFault.exe 67 504 416 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 2300 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 548 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 676 WerFault.exe Token: SeBackupPrivilege 676 WerFault.exe Token: SeDebugPrivilege 676 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe Token: SeDebugPrivilege 2300 WerFault.exe Token: SeDebugPrivilege 548 WerFault.exe Token: SeDebugPrivilege 504 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe052c5f5995d1940da5d2cb6a67f10.exe"C:\Users\Admin\AppData\Local\Temp\bfe052c5f5995d1940da5d2cb6a67f10.exe"1⤵PID:416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:504
-