Analysis
- max time kernel
90s - max time network
149s - platform
windows10_x64 - resource
win10-en - submitted
10/09/2021, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
576d92b98b6a26d7643ab04d94da5a73.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
576d92b98b6a26d7643ab04d94da5a73.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 576d92b98b6a26d7643ab04d94da5a73.exe
- Size 459KB
- Sample210910-m7ebqadagq
- SHA256 0d30fe5bbadded9ff708eb8725f2fd884a92fbffdd8fa093400a549e7b5dcffe
- MD5 576d92b98b6a26d7643ab04d94da5a73
- SHA1 aa7e13b46e5295199ea8bacefc80c74f39b6522c
- SHA512 d27a7869beab55a3c48767e9b2e80de636473024e938ba5abef5f61824bfcb783aeaf51e0e1955361b9eb9808eb9a121a94831070b92693ca4651c445992027e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
6e76410dbdf2085ebcf2777560bd8cb0790329c9
Attributes
-
url4cnc
https://telete.in/bibiOutriggr1
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3136 created 1612 3136 WerFault.exe 68 - Program crash 5 IoCs
pid pid_target Process procid_target 4004 1612 WerFault.exe 68 3572 1612 WerFault.exe 68 2348 1612 WerFault.exe 68 2256 1612 WerFault.exe 68 3136 1612 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 3572 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4004 WerFault.exe Token: SeBackupPrivilege 4004 WerFault.exe Token: SeDebugPrivilege 4004 WerFault.exe Token: SeDebugPrivilege 3572 WerFault.exe Token: SeDebugPrivilege 2348 WerFault.exe Token: SeDebugPrivilege 2256 WerFault.exe Token: SeDebugPrivilege 3136 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\576d92b98b6a26d7643ab04d94da5a73.exe"C:\Users\Admin\AppData\Local\Temp\576d92b98b6a26d7643ab04d94da5a73.exe"1⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 7242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 9162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-