Analysis
- max time kernel
11s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
05/09/2021, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe
- Size 523KB
- Sample210905-p33jvshfc3
- SHA256 1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cbacb2e62f41203055d94
- MD5 56c89fe0f35865101bc33c8ace490195
- SHA1 07d3933dec7651b81e202983be56bb761c2181c5
- SHA512 ff13cdadcf067d3f373e78c09ee2fafaabc72b1f4593c0fdc5e5620b1f3979dbe3d18341121df88778e1d6d4e9d73072dd2a7a312c2998a2952b583e73d68604
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
56be4efb71b0a38de783d05b401b05f1bc805bb2
Attributes
-
url4cnc
https://telete.in/forkmaster123
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3196 created 3996 3196 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 2772 3996 WerFault.exe 68 2736 3996 WerFault.exe 68 1332 3996 WerFault.exe 68 2824 3996 WerFault.exe 68 3196 3996 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2772 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 2824 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2772 WerFault.exe Token: SeBackupPrivilege 2772 WerFault.exe Token: SeDebugPrivilege 2772 WerFault.exe Token: SeDebugPrivilege 2736 WerFault.exe Token: SeDebugPrivilege 1332 WerFault.exe Token: SeDebugPrivilege 2824 WerFault.exe Token: SeDebugPrivilege 3196 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe"C:\Users\Admin\AppData\Local\Temp\1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe"1⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8642⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-