Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08-11-2021 22:00
Static task
static1
Behavioral task
behavioral1
Sample
0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe
Resource
win10-en-20211014
General
-
Target
0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe
-
Size
503KB
-
MD5
1464ae99aba9d814450f869cf640ed7a
-
SHA1
3c5d73cb7259238dc9909ce4d7f886b26a3496a0
-
SHA256
0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8
-
SHA512
9c3b4daeedf0ee4411b663ac382e9dc32e2ad1ece23e95c8d768fb852c9e148f0080aab013e22bc015d710ebfb71bad4d364dd8fc74e0800de64e0e92c9eac23
Malware Config
Extracted
raccoon
1.8.3-hotfix
fcdc156d3872c18d25e3ee45499599b45e492a67
-
url4cnc
http://178.23.190.57/rino115sipsip
http://91.219.236.162/rino115sipsip
http://185.163.47.176/rino115sipsip
http://193.38.54.238/rino115sipsip
http://74.119.192.122/rino115sipsip
http://91.219.236.240/rino115sipsip
https://t.me/rino115sipsip
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 912 created 3168 912 WerFault.exe 0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 912 3168 WerFault.exe 0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe 912 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 912 WerFault.exe Token: SeBackupPrivilege 912 WerFault.exe Token: SeDebugPrivilege 912 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe"C:\Users\Admin\AppData\Local\Temp\0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 8842⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken