Analysis
- max time kernel
72s - max time network
149s - platform
windows10_x64 - resource
win10-en - submitted
06/09/2021, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
4675ecba994b637596d38de8d88a44f5.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4675ecba994b637596d38de8d88a44f5.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 4675ecba994b637596d38de8d88a44f5.exe
- Size 502KB
- Sample210906-1185eaegam
- SHA256 46d8b02f4e0467cec5b88890f2fe263371a90d581e83697b70749aad2f743e18
- MD5 4675ecba994b637596d38de8d88a44f5
- SHA1 57265c99c7d0c4ea2033808efc010352667fece1
- SHA512 26aa5d15b117c49ba35c2eacfdd0d587bde83ce50e472c1c3482ba9fe4a7ff7962326e1c78a9256da5850110c928ee8106e8d12edaa381239c136af1575db13e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4048 created 4656 4048 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 756 4656 WerFault.exe 67 3212 4656 WerFault.exe 67 3984 4656 WerFault.exe 67 3108 4656 WerFault.exe 67 4048 4656 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 756 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 756 WerFault.exe Token: SeBackupPrivilege 756 WerFault.exe Token: SeDebugPrivilege 756 WerFault.exe Token: SeDebugPrivilege 3212 WerFault.exe Token: SeDebugPrivilege 3984 WerFault.exe Token: SeDebugPrivilege 3108 WerFault.exe Token: SeDebugPrivilege 4048 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4675ecba994b637596d38de8d88a44f5.exe"C:\Users\Admin\AppData\Local\Temp\4675ecba994b637596d38de8d88a44f5.exe"1⤵PID:4656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 7682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 8802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-