Analysis
- max time kernel
24s - max time network
116s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/09/2021, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe
- Size 522KB
- Sample210905-mgjhrahee6
- SHA256 e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43db45dbead81d280c58c
- MD5 f545d501be333e5a1ba5bdbb404b031a
- SHA1 80e7545f558c2656ececf3ee2f94795b1b7b84ac
- SHA512 abb83b28335ce6a2433648fc0b57deb09a932006b6c564b876ef89157f2426b4eb90ba31b0b4faac30462c0b7288d6964e9e9b41ccce6e1c756b53c6fb4ab57b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
56be4efb71b0a38de783d05b401b05f1bc805bb2
Attributes
-
url4cnc
https://telete.in/forkmaster123
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3752 created 804 3752 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 2860 804 WerFault.exe 67 1220 804 WerFault.exe 67 2416 804 WerFault.exe 67 2936 804 WerFault.exe 67 3752 804 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2860 WerFault.exe Token: SeBackupPrivilege 2860 WerFault.exe Token: SeDebugPrivilege 2860 WerFault.exe Token: SeDebugPrivilege 1220 WerFault.exe Token: SeDebugPrivilege 2416 WerFault.exe Token: SeDebugPrivilege 2936 WerFault.exe Token: SeDebugPrivilege 3752 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe"C:\Users\Admin\AppData\Local\Temp\e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe"1⤵PID:804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 7202⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752
-