Analysis
-
max time kernel
126s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
06-11-2021 18:42
Static task
static1
Behavioral task
behavioral1
Sample
d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe
Resource
win10-en-20211104
General
-
Target
d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe
-
Size
481KB
-
MD5
e9bf787cd9460ea9648aa46f648d76e9
-
SHA1
b22846669b3c9acea83954f448fa1afeb05379a4
-
SHA256
d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7
-
SHA512
b7612c4b04bf2a5ec7629e5da9cb54733a7c3ad78ed5973c97d259fd341b06d8899c3aa60fe909a9221e3e2e1d20b7aac622738b8a873298e853f98620d8ee3a
Malware Config
Extracted
raccoon
1.8.3
243f5e3056753d9f9706258dce4f79e57c3a9c44
-
url4cnc
http://178.23.190.57/agrybirdsgamerept
http://91.219.236.162/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
http://193.38.54.238/agrybirdsgamerept
http://74.119.192.122/agrybirdsgamerept
http://91.219.236.240/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3652 created 2992 3652 WerFault.exe d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3652 2992 WerFault.exe d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe 3652 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3652 WerFault.exe Token: SeBackupPrivilege 3652 WerFault.exe Token: SeDebugPrivilege 3652 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe"C:\Users\Admin\AppData\Local\Temp\d864d21e1a90dbca2f833e57b71c34291d01956c750454afc1a688fa1a8becc7.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken