Analysis
- max time kernel
29s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/09/2021, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe
- Size 483KB
- Sample210906-1185eabed7
- SHA256 4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864af6ead9dfe6eceac3427
- MD5 0385cf4826000d384e6340a27407219f
- SHA1 1ed6362691e2fb4f112be291c97ea825abbbb607
- SHA512 e5153ed352b35f0c631e6fa5eb5f9f35b4364d54c30b41bea32579fc5ce51e9a0fcacf163a4bf473c56adfc2e64c4cc8a9e862e3dd35979a8a6e07e89979b470
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1380 created 632 1380 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3600 632 WerFault.exe 67 3488 632 WerFault.exe 67 3304 632 WerFault.exe 67 184 632 WerFault.exe 67 1380 632 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3600 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3488 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3600 WerFault.exe Token: SeBackupPrivilege 3600 WerFault.exe Token: SeDebugPrivilege 3600 WerFault.exe Token: SeDebugPrivilege 3488 WerFault.exe Token: SeDebugPrivilege 3304 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 1380 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe"C:\Users\Admin\AppData\Local\Temp\4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe"1⤵PID:632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
-