Analysis
-
max time kernel
119s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 22:01
Static task
static1
Behavioral task
behavioral1
Sample
abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe
Resource
win10-en-20210920
General
-
Target
abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe
-
Size
513KB
-
MD5
94b576115c7f0fe5c3aed538b6258694
-
SHA1
d8e7fd08729ae71d477bb70bca2641dbb519799f
-
SHA256
abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744
-
SHA512
a27afd390b8a9ce84d558037f05a3b73edc37657f5df63522e44c851d42f77aa373b52dfc9ceda2cc3a054ebf3cec2d8dda1da69d429d9d6f7f9d81c0e623d99
Malware Config
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2916 created 2804 2916 WerFault.exe abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2916 2804 WerFault.exe abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe 2916 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2916 WerFault.exe Token: SeBackupPrivilege 2916 WerFault.exe Token: SeDebugPrivilege 2916 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe"C:\Users\Admin\AppData\Local\Temp\abea1dc63f9419bc504c6b38efc140dbd5da184da785cc128c45f39722d50744.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 9842⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken