Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
12-11-2021 20:18
Static task
static1
Behavioral task
behavioral1
Sample
1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe
Resource
win10-en-20211104
General
-
Target
1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe
-
Size
448KB
-
MD5
6c243d736f527bfd101861cbb89b1f92
-
SHA1
0a70009e9c62d68a8fcd0e41a1c356b1f550c60a
-
SHA256
1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2
-
SHA512
399895a0af406915a8e8200de6b9513dfef49f19120fe3dbb4e47cdb95590f5f298add0beed1c02f80881a9214ce688e868000554a14b9b5d3abae57bb9fc21a
Malware Config
Extracted
raccoon
1.8.3-hotfix
4557a7b982bafcd677193713fa5041fa32e7e61e
-
url4cnc
http://91.219.236.162/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
http://193.38.54.238/agrybirdsgamerept
http://74.119.192.122/agrybirdsgamerept
http://91.219.236.240/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1112 created 4088 1112 WerFault.exe 1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1112 4088 WerFault.exe 1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1112 WerFault.exe Token: SeBackupPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 1112 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe"C:\Users\Admin\AppData\Local\Temp\1ab9efe111695feb17f05926de8835c34526f4b6bad37524d13642cbb61edce2.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 9162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken