Analysis
- max time kernel
16s - max time network
120s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/08/2021, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
a78089c4a9550b87124c64519efd673f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a78089c4a9550b87124c64519efd673f.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a78089c4a9550b87124c64519efd673f.exe
- Size 456KB
- Sample210826-yyzp8f4bqa
- SHA256 4ed76dd7aa053fdcffaedd22fdda6b537643f6278451dbb41309dcd533e34295
- MD5 a78089c4a9550b87124c64519efd673f
- SHA1 ba7fa13f54d39324c86ffe9859f2fbb6eed664a7
- SHA512 9ae5a39ef8d23ac70803bee00030c96c3d8ea1d101cdead17c5ecb4134446c733a3738065b7624adada257783383801669b9befceb017d1d9d102dbf072b1e35
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3492 created 2288 3492 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 1404 2288 WerFault.exe 68 3160 2288 WerFault.exe 68 3592 2288 WerFault.exe 68 3396 2288 WerFault.exe 68 3492 2288 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1404 WerFault.exe Token: SeBackupPrivilege 1404 WerFault.exe Token: SeDebugPrivilege 1404 WerFault.exe Token: SeDebugPrivilege 3160 WerFault.exe Token: SeDebugPrivilege 3592 WerFault.exe Token: SeDebugPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 3492 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78089c4a9550b87124c64519efd673f.exe"C:\Users\Admin\AppData\Local\Temp\a78089c4a9550b87124c64519efd673f.exe"1⤵PID:2288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 7642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 7682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-