Analysis
- max time kernel
15s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/08/2021, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
94f53cdf8b29381aae1b0ce158bdc8a0.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
94f53cdf8b29381aae1b0ce158bdc8a0.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 94f53cdf8b29381aae1b0ce158bdc8a0.exe
- Size 456KB
- Sample210826-vx5vfdhcvx
- SHA256 f310e36adaa404c8ab703c29380547dce7d7c2fd4cf508fb7a18264052d4f545
- MD5 94f53cdf8b29381aae1b0ce158bdc8a0
- SHA1 1cbb185bafb72149abb8b9bd8b4c0cd1d87e6f01
- SHA512 7fb8c23391a49ef7fdb31bc76f80cee37e576ce2d2617db1f03a16b3a52ed025360b62a7d2fcc4835de62e0eb60a12cc6f1e5dd439be14c4736f186db5393dd0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
827b865e42181ecfba26ffee236fbb0800626be1
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1540 created 3408 1540 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 1940 3408 WerFault.exe 67 2464 3408 WerFault.exe 67 3960 3408 WerFault.exe 67 3136 3408 WerFault.exe 67 1540 3408 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1940 WerFault.exe Token: SeBackupPrivilege 1940 WerFault.exe Token: SeDebugPrivilege 1940 WerFault.exe Token: SeDebugPrivilege 2464 WerFault.exe Token: SeDebugPrivilege 3960 WerFault.exe Token: SeDebugPrivilege 3136 WerFault.exe Token: SeDebugPrivilege 1540 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94f53cdf8b29381aae1b0ce158bdc8a0.exe"C:\Users\Admin\AppData\Local\Temp\94f53cdf8b29381aae1b0ce158bdc8a0.exe"1⤵PID:3408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 8722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-