Analysis
- max time kernel
43s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/09/2021, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
5f7c52e58df2b80a99bbaf40d0cd70af.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5f7c52e58df2b80a99bbaf40d0cd70af.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 5f7c52e58df2b80a99bbaf40d0cd70af.exe
- Size 574KB
- Sample210901-lrkse6ll2x
- SHA256 55eebe9d7ba942dc7e308f277389bc5f4412fba5c828c2b1b154a1bc3b514dbf
- MD5 5f7c52e58df2b80a99bbaf40d0cd70af
- SHA1 cbfa428959c51a8c156fe8f1569e33b3f13b724f
- SHA512 41a36ca3eb87fb7403ec8547e31d23f7d3b3b173fe9a307cd3cf44f8535ccf336ba7b27439a4d072b563ed3eb473b649f52832d8ff9297690398b468f7aa1a1b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2384 created 900 2384 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3672 900 WerFault.exe 67 496 900 WerFault.exe 67 3912 900 WerFault.exe 67 192 900 WerFault.exe 67 2384 900 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe 2384 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3672 WerFault.exe Token: SeBackupPrivilege 3672 WerFault.exe Token: SeDebugPrivilege 3672 WerFault.exe Token: SeDebugPrivilege 496 WerFault.exe Token: SeDebugPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 2384 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f7c52e58df2b80a99bbaf40d0cd70af.exe"C:\Users\Admin\AppData\Local\Temp\5f7c52e58df2b80a99bbaf40d0cd70af.exe"1⤵PID:900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 7802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 8642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 9362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 9162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-