Analysis
-
max time kernel
52s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en -
submitted
08-09-2021 08:10
Static task
static1
Behavioral task
behavioral1
Sample
9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe
Resource
win10-en
General
-
Target
9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe
-
Size
428KB
-
MD5
783f4d0de698f381e7e5d2a7b8286747
-
SHA1
8d9428aeb487ebfc2fc40b4c3075450c5d90c0ad
-
SHA256
9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3
-
SHA512
0ea6771aa1d01f9b5ab701d04440c7a6de334a0086b8ac033169e622059f6c3cf0a17c18422d54bed46f2d56fa2407882c4dc1f0300c9b1a99a8b6abdf90857f
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4224 created 4476 4224 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe -
Loads dropped DLL 1 IoCs
Processes:
9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exepid process 4476 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3724 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4048 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 708 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4028 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4312 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4356 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4264 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4364 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 508 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 652 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 2888 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 2768 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4420 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe 4224 4476 WerFault.exe 9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 3724 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 4048 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 708 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3724 WerFault.exe Token: SeBackupPrivilege 3724 WerFault.exe Token: SeDebugPrivilege 3724 WerFault.exe Token: SeDebugPrivilege 4048 WerFault.exe Token: SeDebugPrivilege 708 WerFault.exe Token: SeDebugPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 4312 WerFault.exe Token: SeDebugPrivilege 4356 WerFault.exe Token: SeDebugPrivilege 4264 WerFault.exe Token: SeDebugPrivilege 4364 WerFault.exe Token: SeDebugPrivilege 508 WerFault.exe Token: SeDebugPrivilege 652 WerFault.exe Token: SeDebugPrivilege 2888 WerFault.exe Token: SeDebugPrivilege 2768 WerFault.exe Token: SeDebugPrivilege 4420 WerFault.exe Token: SeDebugPrivilege 4224 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe"C:\Users\Admin\AppData\Local\Temp\9ffea31df5176daa4b689b2cdf544a3df2722a640212c8000dea35bfbdfe21e3.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 7682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 9602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 12002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 11842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 11682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 12602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 13162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 13522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 11562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 13922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 13082⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
memory/4476-116-0x0000000000400000-0x0000000002189000-memory.dmpFilesize
29.5MB
-
memory/4476-115-0x00000000023D0000-0x000000000245F000-memory.dmpFilesize
572KB