Analysis
- max time kernel
15s - max time network
134s - platform
windows10_x64 - resource
win10-en - submitted
01/09/2021, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
abb67941245047889df4a4cec2e3f533b4085f393281f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
abb67941245047889df4a4cec2e3f533b4085f393281f.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target abb67941245047889df4a4cec2e3f533b4085f393281f.exe
- Size 574KB
- Sample210901-9678jqvez2
- SHA256 abb67941245047889df4a4cec2e3f533b4085f393281fba6db017a2c7153be5c
- MD5 62e941c948ccbf6c33e31e1608f33630
- SHA1 f990ced857963d46efb4cfd1ea536ef7bd1fad79
- SHA512 0fe3e14fcb501c9372f45d664437b4d01f12ddb2c4bb5e75eafbdfe24feed4c5402823a57633e496540c89bebfe66f7542a9fe5494532f742093b1343d85990d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4124 created 4472 4124 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 4088 4472 WerFault.exe 68 3984 4472 WerFault.exe 68 3968 4472 WerFault.exe 68 4132 4472 WerFault.exe 68 4124 4472 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4132 WerFault.exe 4124 WerFault.exe 4124 WerFault.exe 4124 WerFault.exe 4124 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4088 WerFault.exe Token: SeBackupPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 3984 WerFault.exe Token: SeDebugPrivilege 3968 WerFault.exe Token: SeDebugPrivilege 4132 WerFault.exe Token: SeDebugPrivilege 4124 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abb67941245047889df4a4cec2e3f533b4085f393281f.exe"C:\Users\Admin\AppData\Local\Temp\abb67941245047889df4a4cec2e3f533b4085f393281f.exe"1⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 7162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 8282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-