Analysis
- max time kernel
21s - max time network
115s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/09/2021, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
bdeae2386b5963ca706f122e92006b0a.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bdeae2386b5963ca706f122e92006b0a.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target bdeae2386b5963ca706f122e92006b0a.exe
- Size 421KB
- Sample210908-drccraggcr
- SHA256 e3be914d9ad0a4eb020c1b7bd796b03fd452b6bbccf540caa0e576ee1fbcdd0f
- MD5 bdeae2386b5963ca706f122e92006b0a
- SHA1 f95065652e6023c8999351f7b8fe6bf264d583e0
- SHA512 92b072af482fdde80c5ea0e86c55267551cd0d0350472f01428f7d7f4cb9966ec292882ab2b46aab742b791aedc02cb8b64add240483edd1e3457831ddf3f100
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3164 created 3628 3164 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 3668 3628 WerFault.exe 67 4076 3628 WerFault.exe 67 196 3628 WerFault.exe 67 2196 3628 WerFault.exe 67 3164 3628 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 3668 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe 3164 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3668 WerFault.exe Token: SeBackupPrivilege 3668 WerFault.exe Token: SeDebugPrivilege 3668 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 196 WerFault.exe Token: SeDebugPrivilege 2196 WerFault.exe Token: SeDebugPrivilege 3164 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdeae2386b5963ca706f122e92006b0a.exe"C:\Users\Admin\AppData\Local\Temp\bdeae2386b5963ca706f122e92006b0a.exe"1⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 7362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-