Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2023 19:47
Static task
static1
Behavioral task
behavioral1
Sample
16a9bd684974d09703804d773e0252a2.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
16a9bd684974d09703804d773e0252a2.exe
-
Size
433KB
-
MD5
16a9bd684974d09703804d773e0252a2
-
SHA1
6b5d36a88c0a98e0d211f99ef55ca6eb40e9dfb0
-
SHA256
faeffb395139b51e0c53f62d7103bc8cdda88fcb719b51a83d81efd627a9aca6
-
SHA512
b8e3feee0db24650a489a4df908ad48c53966da160b4e99124998afced24647793d1ea6fe7a193df4d9673b690eab906347f78852d8f84ef18fbe2b9b4ce0898
-
SSDEEP
6144:w5TWB/lIhQsQ8BO57QNG4C1FS0WV98NDS96sVo8tGUKuSDCV+E:w5OtvsQ8E576CrrWH4qw5CVr
Malware Config
Extracted
Family
gcleaner
C2
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Downloads MZ/PE file
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4080 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 508 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 856 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 2932 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 2728 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 952 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 212 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 4280 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 4268 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 4564 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 4008 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 1264 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe 2296 4496 WerFault.exe 16a9bd684974d09703804d773e0252a2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16a9bd684974d09703804d773e0252a2.exe"C:\Users\Admin\AppData\Local\Temp\16a9bd684974d09703804d773e0252a2.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 11322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 15002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 15882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 17682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 17642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 16002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 15402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4496 -ip 44961⤵