Analysis
- max time kernel
18s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
27/08/2021, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
72e7c39c1be42ae6de7fd0f1f5d76567.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
72e7c39c1be42ae6de7fd0f1f5d76567.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 72e7c39c1be42ae6de7fd0f1f5d76567.exe
- Size 455KB
- Sample210827-4s9hraj77j
- SHA256 cbb0fe7bfdb3ea7f08a2c55becd1d442c11b790d02e57518657a3fe6065ba92e
- MD5 72e7c39c1be42ae6de7fd0f1f5d76567
- SHA1 b123b67dac6862cf028eb1fa6716b180b6480ce3
- SHA512 6f98502252cf041a6e6b151840ceee4a967f0be6541e5a106fd77d0bfd636698bc52cab8220360202ed3f126b1151d5a3a47f72829e27241d45343015a5d1d56
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
827b865e42181ecfba26ffee236fbb0800626be1
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3420 created 4048 3420 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3712 4048 WerFault.exe 67 192 4048 WerFault.exe 67 3196 4048 WerFault.exe 67 2652 4048 WerFault.exe 67 3420 4048 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3712 WerFault.exe Token: SeBackupPrivilege 3712 WerFault.exe Token: SeDebugPrivilege 3712 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 3196 WerFault.exe Token: SeDebugPrivilege 2652 WerFault.exe Token: SeDebugPrivilege 3420 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72e7c39c1be42ae6de7fd0f1f5d76567.exe"C:\Users\Admin\AppData\Local\Temp\72e7c39c1be42ae6de7fd0f1f5d76567.exe"1⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 7442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-