Analysis
-
max time kernel
80s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-04-2022 02:32
Static task
static1
Behavioral task
behavioral1
Sample
test9.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test9.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
test9.exe
-
Size
552KB
-
MD5
6b2a1bdeb277bbec7ca7b450787dd2ee
-
SHA1
62d8acc30d74066aa4e2bd7c30bfa99ad1b4574c
-
SHA256
fd7b01818107ade3811fe5070491ef2a4bb208ca68bb07710f5c540e44a1e97b
-
SHA512
cc32e883b9a10d8e774ebec3affeacca7bff573061043d2ef74d638d24977646e3ff3580ddd587e8c6739b2d9b5de0532917e39cc1a20ba2a7c8c3141edcb8af
Malware Config
Extracted
Family
raccoon
Botnet
4a4c4acb62708e2b8f51583787f979bb17da6731
Attributes
-
url4cnc
http://185.163.204.81/sendmenuw
http://194.180.191.33/sendmenuw
http://174.138.11.98/sendmenuw
http://194.180.191.44/sendmenuw
http://91.219.236.120/sheinl
https://t.me/sendmenuw
rc4.plain
rc4.plain
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\test9.exe"C:\Users\Admin\AppData\Local\Temp\test9.exe"1⤵PID:1488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 9322⤵
- Program crash
PID:4912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1488 -ip 14881⤵PID:4916