Analysis
- max time kernel
18s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/09/2021, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
a9497b9a942168e0024089083f204848.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9497b9a942168e0024089083f204848.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target a9497b9a942168e0024089083f204848.exe
- Size 524KB
- Sample210907-rwbtnsgabj
- SHA256 cd682f673e7dfbeac62b8e2fad4afa3fd12e25faf8356635f4ff76c4dd326cbf
- MD5 a9497b9a942168e0024089083f204848
- SHA1 272aef9f39aa624977b6a41a3de6ffbcdc360bff
- SHA512 635207f0f212378a44b6d5eac3ca7601c3bbd7597e54e70078cfa34f67bf9e3c2e70f26f019d8acfb123aee959471f4296e159fca4a6c4c9a8bce06df8716998
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
56be4efb71b0a38de783d05b401b05f1bc805bb2
Attributes
-
url4cnc
https://telete.in/forkmaster123
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1568 created 992 1568 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3200 992 WerFault.exe 67 808 992 WerFault.exe 67 1236 992 WerFault.exe 67 1972 992 WerFault.exe 67 1568 992 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 3200 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1236 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3200 WerFault.exe Token: SeBackupPrivilege 3200 WerFault.exe Token: SeDebugPrivilege 3200 WerFault.exe Token: SeDebugPrivilege 808 WerFault.exe Token: SeDebugPrivilege 1236 WerFault.exe Token: SeDebugPrivilege 1972 WerFault.exe Token: SeDebugPrivilege 1568 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9497b9a942168e0024089083f204848.exe"C:\Users\Admin\AppData\Local\Temp\a9497b9a942168e0024089083f204848.exe"1⤵PID:992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 8162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 7242⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-