Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
14-11-2021 09:15
Static task
static1
Behavioral task
behavioral1
Sample
77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe
Resource
win10-en-20211104
General
-
Target
77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe
-
Size
500KB
-
MD5
d513e817da5fbce634ed9609ca78e589
-
SHA1
95c8614b7c7a709a278a45ae3b7579c9c167ea54
-
SHA256
77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674
-
SHA512
49055ea2137dd1ef65ce8a8932a109c6f06a0ea6bd3fecf3e1c52aabc5dc6cc998b45fef4f030bc3f76e1d25f201f005dbb968e1ea29be7719fd6fb6f413d63a
Malware Config
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4252 created 4024 4252 WerFault.exe 77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4252 4024 WerFault.exe 77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe 4252 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4252 WerFault.exe Token: SeBackupPrivilege 4252 WerFault.exe Token: SeDebugPrivilege 4252 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe"C:\Users\Admin\AppData\Local\Temp\77a28b993e27b8249fa5463748ed15cf0a513402a25bbd72fc00b96fd321e674.exe"1⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 8642⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252