Analysis
- max time kernel
15s - max time network
115s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/08/2021, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
d9849cf49660ccb07d7a2066b9bddbc9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d9849cf49660ccb07d7a2066b9bddbc9.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target d9849cf49660ccb07d7a2066b9bddbc9.exe
- Size 455KB
- Sample210826-kdlv7lr1sa
- SHA256 7e1526e8a418dc74b5d9d2666ba67cb511bead21bb770db5a75dc7e4db77a90a
- MD5 d9849cf49660ccb07d7a2066b9bddbc9
- SHA1 69262560cf5216d50e9b289863f1946c6a0fc71e
- SHA512 7e5493b5caa13b41860a74cc49affc566341d249dd15969eb06482b3b0ccbe48966d3099b88efa620124f5638f7820a2033e8cb699feb5504b724eb3b172e70c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3928 created 2672 3928 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 2120 2672 WerFault.exe 68 1120 2672 WerFault.exe 68 3252 2672 WerFault.exe 68 188 2672 WerFault.exe 68 3928 2672 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 3252 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 3928 WerFault.exe 3928 WerFault.exe 3928 WerFault.exe 3928 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2120 WerFault.exe Token: SeBackupPrivilege 2120 WerFault.exe Token: SeDebugPrivilege 2120 WerFault.exe Token: SeDebugPrivilege 1120 WerFault.exe Token: SeDebugPrivilege 3252 WerFault.exe Token: SeDebugPrivilege 188 WerFault.exe Token: SeDebugPrivilege 3928 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9849cf49660ccb07d7a2066b9bddbc9.exe"C:\Users\Admin\AppData\Local\Temp\d9849cf49660ccb07d7a2066b9bddbc9.exe"1⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 7722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 8802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-