Analysis
- max time kernel
47s - max time network
151s - platform
windows10_x64 - resource
win10-en - submitted
06/09/2021, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe
- Size 504KB
- Sample210906-11mleabeb8
- SHA256 b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c80282c54edd0aeefcf0
- MD5 eb537ce66682ab64d2c82713a8dd9ef3
- SHA1 df5b934364cf4376e95b9f05aefef0d0521119d3
- SHA512 e8897c2bf32a430bbf62408bc574fb399ec697b19f980f9f5294e0bec07a756eaad30c8ed18f24cc6a7bfde7c08b8a49a316811b197c4508ee772d34837c6f6a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4368 created 4800 4368 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 4064 4800 WerFault.exe 68 1536 4800 WerFault.exe 68 4440 4800 WerFault.exe 68 4452 4800 WerFault.exe 68 4368 4800 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4452 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe 4368 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4064 WerFault.exe Token: SeBackupPrivilege 4064 WerFault.exe Token: SeDebugPrivilege 4064 WerFault.exe Token: SeDebugPrivilege 1536 WerFault.exe Token: SeDebugPrivilege 4440 WerFault.exe Token: SeDebugPrivilege 4452 WerFault.exe Token: SeDebugPrivilege 4368 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe"C:\Users\Admin\AppData\Local\Temp\b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe"1⤵PID:4800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 9282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-