Analysis
- max time kernel
17s - max time network
139s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/08/2021, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
b6bc146e7e2f88afc9b81dc6cb4e4c54.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b6bc146e7e2f88afc9b81dc6cb4e4c54.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target b6bc146e7e2f88afc9b81dc6cb4e4c54.exe
- Size 429KB
- Sample210828-dt2cj7byte
- SHA256 8ea7e098522cb46482fad73b8abf73f6c74f85d5e42953eb5353d5bfeb9497d0
- MD5 b6bc146e7e2f88afc9b81dc6cb4e4c54
- SHA1 dbd03a9b751c8aadad427f11840faf58e82b0fc7
- SHA512 ed1c9d57915cf34d7c871cb4347d1c8f33d4be1debc99777423a1b5014dfb5e7cee8c4ba22427acf3023ac4c4339455b7801cf4a0b040f5cd50b9ae1441fcd4f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
be17623a7e46bbe6227e16dde04d43b81a77bd4b
Attributes
-
url4cnc
https://telete.in/vvizAgentLost
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4080 created 3128 4080 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 1164 3128 WerFault.exe 67 3636 3128 WerFault.exe 67 2268 3128 WerFault.exe 67 3772 3128 WerFault.exe 67 4080 3128 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 3636 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1164 WerFault.exe Token: SeBackupPrivilege 1164 WerFault.exe Token: SeDebugPrivilege 1164 WerFault.exe Token: SeDebugPrivilege 3636 WerFault.exe Token: SeDebugPrivilege 2268 WerFault.exe Token: SeDebugPrivilege 3772 WerFault.exe Token: SeDebugPrivilege 4080 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6bc146e7e2f88afc9b81dc6cb4e4c54.exe"C:\Users\Admin\AppData\Local\Temp\b6bc146e7e2f88afc9b81dc6cb4e4c54.exe"1⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080
-