Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 19:13
Static task
static1
Behavioral task
behavioral1
Sample
0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe
Resource
win10-en-20210920
General
-
Target
0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe
-
Size
513KB
-
MD5
18b193c34923f4f2aa44fb8675f64993
-
SHA1
30d430349129b556546c085f92baa2034853471f
-
SHA256
0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181
-
SHA512
b2001ce78c83318304c9740365e7ef0db5830bb156c73c398baac38d65e3a27f5a4d603860de6ff65d8c270f5eb53a20f3c648c93d69e917cd51ef38a501cd21
Malware Config
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3204 created 1836 3204 WerFault.exe 0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3204 1836 WerFault.exe 0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3204 WerFault.exe Token: SeBackupPrivilege 3204 WerFault.exe Token: SeDebugPrivilege 3204 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe"C:\Users\Admin\AppData\Local\Temp\0e9e98cde28f8dd9a22f642400452d84762785efeb72ecdf49c317d44624f181.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 6402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken