Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 19:10
Static task
static1
Behavioral task
behavioral1
Sample
fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe
Resource
win10-en-20211014
General
-
Target
fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe
-
Size
3.7MB
-
MD5
b022fa2b1beb55aee7bb0f1fb351ae1f
-
SHA1
ceedd470b439a8249b53ba6c6e74fa2a51b3c0c0
-
SHA256
fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c
-
SHA512
13bc948f106013594fb0b20d7bf785cdd10d97ad6830951749200866d3424b3be6c6a60a4176bca6c7e5f7b841c569ea1b6436edd60e510c955e34994fc9fcfd
Malware Config
Extracted
raccoon
cf3e15a8aec8fe7eead8f124a5222c57fad37d42
-
url4cnc
http://telegatt.top/dodgeneontwinturbo
http://telegka.top/dodgeneontwinturbo
http://telegin.top/dodgeneontwinturbo
https://t.me/dodgeneontwinturbo
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4496 created 4284 4496 WerFault.exe fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4496 4284 WerFault.exe fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe 4496 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4496 WerFault.exe Token: SeBackupPrivilege 4496 WerFault.exe Token: SeDebugPrivilege 4496 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe"C:\Users\Admin\AppData\Local\Temp\fe5baacf899eaf4343aaf323af83d76f1d7b6a0c565826338cc46635118e2d9c.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 9722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4284-115-0x0000000000B30000-0x0000000001111000-memory.dmpFilesize
5.9MB