Analysis
-
max time kernel
13s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en -
submitted
07-09-2021 22:40
Static task
static1
Behavioral task
behavioral1
Sample
dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe
-
Size
421KB
-
MD5
a836dd578e9c7f5402c39abd6b2c10ff
-
SHA1
288dceed734aef555ff55bf983d5d813fe70abf1
-
SHA256
dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb
-
SHA512
ec7a809e771260a496c66b5f87e45b883ebb901fffca8121fdc3bbb5527e769a0ba49731a740ad4000cf215d233a70dc82a0c92c5fb19d96af2db07be0eb3126
Malware Config
Extracted
Family
raccoon
Botnet
93d3ccba4a3cbd5e268873fc1760b2335272e198
Attributes
-
url4cnc
https://telete.in/opa4kiprivatem
rc4.plain
rc4.plain
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2168 created 4032 2168 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2852 4032 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe 1268 4032 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe 3104 4032 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe 1112 4032 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe 2168 4032 WerFault.exe dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2852 WerFault.exe Token: SeBackupPrivilege 2852 WerFault.exe Token: SeDebugPrivilege 2852 WerFault.exe Token: SeDebugPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 3104 WerFault.exe Token: SeDebugPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 2168 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe"C:\Users\Admin\AppData\Local\Temp\dd2f2ec66b440c95c3ff38139baa7893c843cd0b8ee6cb78c6f4e7b3ccda4dbb.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 8882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken