Analysis
- max time kernel
32s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
05/09/2021, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
5dadb777edf175b11347a15c386a28e9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5dadb777edf175b11347a15c386a28e9.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 5dadb777edf175b11347a15c386a28e9.exe
- Size 517KB
- Sample210905-mdncjahec7
- SHA256 6e2bf5a1a59b6936fa85bbfda3c6733e19f07afaaf026ed0a3d00634252d0133
- MD5 5dadb777edf175b11347a15c386a28e9
- SHA1 ba9fc62325b2d9499afc0a59c4666a16368e1ea8
- SHA512 f7815af47148c248fd998e3673460a08631671e87e3dd11712891e2ba43f2156411c6a0b21d4bc9ce86e73058990fd737e0138071d6fdf1da40767181fc7822b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3496 created 3652 3496 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 404 3652 WerFault.exe 68 3156 3652 WerFault.exe 68 3304 3652 WerFault.exe 68 4088 3652 WerFault.exe 68 3496 3652 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 404 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 3496 WerFault.exe 3496 WerFault.exe 3496 WerFault.exe 3496 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 404 WerFault.exe Token: SeBackupPrivilege 404 WerFault.exe Token: SeDebugPrivilege 404 WerFault.exe Token: SeDebugPrivilege 3156 WerFault.exe Token: SeDebugPrivilege 3304 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 3496 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dadb777edf175b11347a15c386a28e9.exe"C:\Users\Admin\AppData\Local\Temp\5dadb777edf175b11347a15c386a28e9.exe"1⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 8282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-