Analysis
- max time kernel
34s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/08/2021, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
cb6862d118abf5a9547dec191a40604b.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cb6862d118abf5a9547dec191a40604b.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target cb6862d118abf5a9547dec191a40604b.exe
- Size 487KB
- Sample210830-wejqlngls6
- SHA256 6a39e039b505a8dc77840f5f7992ab2147e80e7e254965abcfed37146a92acbb
- MD5 cb6862d118abf5a9547dec191a40604b
- SHA1 50baf07fb1817dedd24949b719f221b61504842d
- SHA512 bee40251622af0aa3f4219ac7e94f2211426e6fca9b592f27f76f8f3ca23f9a3c0ceea9ec364e1928bb0b1b37a3debee8f6fc9246ec81d4071ea67479498e591
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2724 created 604 2724 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 220 604 WerFault.exe 67 2208 604 WerFault.exe 67 3856 604 WerFault.exe 67 788 604 WerFault.exe 67 2724 604 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 220 WerFault.exe Token: SeBackupPrivilege 220 WerFault.exe Token: SeDebugPrivilege 220 WerFault.exe Token: SeDebugPrivilege 2208 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 788 WerFault.exe Token: SeDebugPrivilege 2724 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb6862d118abf5a9547dec191a40604b.exe"C:\Users\Admin\AppData\Local\Temp\cb6862d118abf5a9547dec191a40604b.exe"1⤵PID:604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 9042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-