Analysis
-
max time kernel
18s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-09-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe
Resource
win10v20210408
General
-
Target
f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe
-
Size
428KB
-
MD5
611401a3bc2ff42c97078d6b473b6d23
-
SHA1
02643bbf80262499009ec749728b6e5a5bbeac6f
-
SHA256
f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948
-
SHA512
9edca3cd51443ec2bd707292db65b5815243a79a61b6836b9fd90ecfe7e1cff5a2cdce95038341a13c251d9233ca49703f02826a62c1cdb44a59ab2754fd4bbb
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2152 created 3128 2152 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe -
Loads dropped DLL 1 IoCs
Processes:
f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exepid process 3128 f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2532 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 2056 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 2388 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 3756 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 2352 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 3804 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 4084 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 3644 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 2096 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 1184 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 3676 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 580 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 1500 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe 2152 3128 WerFault.exe f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2532 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2056 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 3756 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2532 WerFault.exe Token: SeBackupPrivilege 2532 WerFault.exe Token: SeDebugPrivilege 2532 WerFault.exe Token: SeDebugPrivilege 2056 WerFault.exe Token: SeDebugPrivilege 2388 WerFault.exe Token: SeDebugPrivilege 3756 WerFault.exe Token: SeDebugPrivilege 2352 WerFault.exe Token: SeDebugPrivilege 3804 WerFault.exe Token: SeDebugPrivilege 4084 WerFault.exe Token: SeDebugPrivilege 3644 WerFault.exe Token: SeDebugPrivilege 2096 WerFault.exe Token: SeDebugPrivilege 1184 WerFault.exe Token: SeDebugPrivilege 580 WerFault.exe Token: SeDebugPrivilege 1500 WerFault.exe Token: SeDebugPrivilege 2152 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe"C:\Users\Admin\AppData\Local\Temp\f57f261dcc8b1578db3e24361c1b3bf9e84db0a770d4663fa393440c8c1c1948.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 9002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 11962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 12082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 12082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 13562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
memory/3128-114-0x0000000002430000-0x00000000024BF000-memory.dmpFilesize
572KB
-
memory/3128-115-0x0000000000400000-0x0000000002189000-memory.dmpFilesize
29.5MB