Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
28-10-2021 17:13
Static task
static1
Behavioral task
behavioral1
Sample
a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe
Resource
win10-en-20211014
General
-
Target
a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe
-
Size
464KB
-
MD5
4aed76af62b8b2f833018d87f0f9379f
-
SHA1
0815c91b0505700484e15bdfeb61a86155fe267e
-
SHA256
a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca
-
SHA512
981b427057d38cde1908e3baeb15034a514e9e8052b0654fb979f600d75c86fc28a6ffb4de2b176c5469811ad609ac8d4afd5bcc1aa5771a17535aa8bce6cb26
Malware Config
Extracted
raccoon
60e59be328fbd2ebac1839ea99411dccb00a6f49
-
url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4068 created 3704 4068 WerFault.exe a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4068 3704 WerFault.exe a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe 4068 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4068 WerFault.exe Token: SeBackupPrivilege 4068 WerFault.exe Token: SeDebugPrivilege 4068 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe"C:\Users\Admin\AppData\Local\Temp\a2df75a65b6666e1a5f2c04cce688cf97921ce4e235804570d3f8533877a2eca.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 9802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken