Analysis
- max time kernel
73s - max time network
75s - platform
windows10_x64 - resource
win10v20210408 - submitted
18/09/2021, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
a2a6ffece639aedc0c9e6199b7061ac3.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2a6ffece639aedc0c9e6199b7061ac3.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target a2a6ffece639aedc0c9e6199b7061ac3.exe
- Size 428KB
- Sample210918-e5dneaghc7
- SHA256 c35eedcc8bf96a803602d28b7597f7eb4874277ef31508e1ab7f4dcb63c49bf4
- MD5 a2a6ffece639aedc0c9e6199b7061ac3
- SHA1 4d9db9c21d3b03f1533933a24f30c0e1343acc66
- SHA512 37e130942603270a5c8b31f6c8cec0347ed811695b8f07268c0181b0f092b3393b0f80acdd725121cbc76d1287d2f28431bce51995a6c7afc1a6764055d36c31
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
raccoon
Botnet
-
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1656 created 640 1656 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 736 640 WerFault.exe 67 1268 640 WerFault.exe 67 1376 640 WerFault.exe 67 1532 640 WerFault.exe 67 1656 640 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 736 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 736 WerFault.exe Token: SeBackupPrivilege 736 WerFault.exe Token: SeDebugPrivilege 736 WerFault.exe Token: SeDebugPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 1376 WerFault.exe Token: SeDebugPrivilege 1532 WerFault.exe Token: SeDebugPrivilege 1656 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2a6ffece639aedc0c9e6199b7061ac3.exe"C:\Users\Admin\AppData\Local\Temp\a2a6ffece639aedc0c9e6199b7061ac3.exe"1⤵PID:640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 8562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 8642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 8802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656
-