Analysis
-
max time kernel
61s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
04a0a92818fff9b931159046aae65313.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
04a0a92818fff9b931159046aae65313.exe
-
Size
286KB
-
MD5
04a0a92818fff9b931159046aae65313
-
SHA1
5d216cceee67ac22373e4ef81ae09f7bed148c3b
-
SHA256
81cbb252bf93891c7ff2242c6e792e7dbfc1dcc39cb17ebb47f2b630a46ca4e8
-
SHA512
cc24a04193961ee240719974f9969201bb6d21caad6c4cb6f428b0b6d6e1474409384a105f66d7f3f64da6b828d3c3d1c06f07798af18202d535f7864d4c53ad
-
SSDEEP
3072:hnyj+CWonmWRoMehGOiyks2d0rdyFrmsKgRJhqfI9Wcvta1xnid3GDHia0W5cqVd:t1nWRG0ZY2dPZrKg4fI9Bt2DbUqnP
Malware Config
Extracted
Family
gcleaner
C2
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Downloads MZ/PE file
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1388 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 4892 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 3956 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 4796 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 4420 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 1796 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 2476 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 408 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 4244 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 1764 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 2968 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 3412 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe 3380 3304 WerFault.exe 04a0a92818fff9b931159046aae65313.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04a0a92818fff9b931159046aae65313.exe"C:\Users\Admin\AppData\Local\Temp\04a0a92818fff9b931159046aae65313.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 13202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 14922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 15682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 17482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 15402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 15722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 15042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3304 -ip 33041⤵