Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08-11-2021 09:58
Static task
static1
Behavioral task
behavioral1
Sample
ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe
Resource
win10-en-20211104
General
-
Target
ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe
-
Size
533KB
-
MD5
a056fafc86c0a8cffd016ad6883695e1
-
SHA1
28af57210237b0475e00b4eabb0c9dcd07c1d47f
-
SHA256
ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc
-
SHA512
428287ee89bbea841b26f2a85c051a0515c46677cfd54fbd1a6206a18bbb91da74bffb48c6bcbb77c347429125b9f07d5b20f92af52683240e084ba4ae7b36c1
Malware Config
Extracted
raccoon
1.8.3
243f5e3056753d9f9706258dce4f79e57c3a9c44
-
url4cnc
http://178.23.190.57/agrybirdsgamerept
http://91.219.236.162/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
http://193.38.54.238/agrybirdsgamerept
http://74.119.192.122/agrybirdsgamerept
http://91.219.236.240/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4172 created 3984 4172 WerFault.exe ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4172 3984 WerFault.exe ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe 4172 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4172 WerFault.exe Token: SeBackupPrivilege 4172 WerFault.exe Token: SeDebugPrivilege 4172 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe"C:\Users\Admin\AppData\Local\Temp\ee6a1e4c8a5381d2f848cc3cf000ce21431d9479740a07d32638c9c6a50e6fcc.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 9002⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken