Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-11-2021 16:33
Static task
static1
Behavioral task
behavioral1
Sample
b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe
Resource
win10-en-20211104
General
-
Target
b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe
-
Size
547KB
-
MD5
ba8c9fe7f2be8158afd346f6d53467c6
-
SHA1
32239a11f8a6c4205ee524b8fe37a5cea715c88e
-
SHA256
b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3
-
SHA512
4519386dd83f48169f7606da4b2c55288d0eab587550e1d84dd881647f70aa68a7f6bc2fcc4a3c490c1d1a561607292238a8c435f367c4db8d2c0c8108dad192
Malware Config
Extracted
raccoon
1.8.3
243f5e3056753d9f9706258dce4f79e57c3a9c44
-
url4cnc
http://178.23.190.57/agrybirdsgamerept
http://91.219.236.162/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
http://193.38.54.238/agrybirdsgamerept
http://74.119.192.122/agrybirdsgamerept
http://91.219.236.240/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 200 created 2816 200 WerFault.exe b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 200 2816 WerFault.exe b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 200 WerFault.exe Token: SeBackupPrivilege 200 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe"C:\Users\Admin\AppData\Local\Temp\b22c827cfafbd1dd10a3d9582fb86d35f4cc89e3b622997f6dd9c3a2f18566c3.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 6482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken