Analysis
- max time kernel
15s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/08/2021, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee.exe
- Size 456KB
- Sample210826-lyplbdqejx
- SHA256 17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee77db8fb34a92c388909
- MD5 74fd9b3fdf92d25dd62fcc090ce31eec
- SHA1 eb2a5d91779b7c06855247d8987c9fd336ba31e2
- SHA512 994f4490f1f42ce5846ece5bfa5b9adaf3a3512fb720fc22a2a77c1c1022e00485721c21df2f67071cfa0e188cb2f4133dd960c8081a14f48b28b2293b1fb6e1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2508 created 4016 2508 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 4028 4016 WerFault.exe 67 3156 4016 WerFault.exe 67 1232 4016 WerFault.exe 67 1320 4016 WerFault.exe 67 2508 4016 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 2508 WerFault.exe 2508 WerFault.exe 2508 WerFault.exe 2508 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4028 WerFault.exe Token: SeBackupPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 3156 WerFault.exe Token: SeDebugPrivilege 1232 WerFault.exe Token: SeDebugPrivilege 1320 WerFault.exe Token: SeDebugPrivilege 2508 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee.exe"C:\Users\Admin\AppData\Local\Temp\17063a46e83079e4cd2d9cb8309fe04ba7cdcc492b3ee.exe"1⤵PID:4016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 7522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-