Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2023, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
2d257873ee0ae75c9b89bd340e3e3da6.exe
Resource
win7-20230621-en
General
-
Target
2d257873ee0ae75c9b89bd340e3e3da6.exe
-
Size
362KB
-
MD5
2d257873ee0ae75c9b89bd340e3e3da6
-
SHA1
9dd9080df32b375f39df6470136a5bb107829eba
-
SHA256
f6cf800d44ff24fc1d1c06ccb0df605c5585f56fd041d335a5fe15628a1e9428
-
SHA512
e89156f93c1ddb1292d31477e4d05937fc3a091a9868842f5cf861b9bea3c521c839cc557a8dcab0e3d651561b2d06392fcc9426278cd7797c2abeb6f5df5753
-
SSDEEP
3072:aYCP40soI6S4OjdPhhFZzWUE6itRd8iEmP7WLig/ZT4rNXeCLshvYJREGKm3aGjR:g4V6IV7ErRlEakMJXbsqQjmKJuF25V8
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation 2d257873ee0ae75c9b89bd340e3e3da6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
pid pid_target Process procid_target 1540 2824 WerFault.exe 84 3332 2824 WerFault.exe 84 4340 2824 WerFault.exe 84 1476 2824 WerFault.exe 84 1432 2824 WerFault.exe 84 3188 2824 WerFault.exe 84 4592 2824 WerFault.exe 84 1340 2824 WerFault.exe 84 2840 2824 WerFault.exe 84 3880 2824 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 5016 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5016 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2824 wrote to memory of 1664 2824 2d257873ee0ae75c9b89bd340e3e3da6.exe 107 PID 2824 wrote to memory of 1664 2824 2d257873ee0ae75c9b89bd340e3e3da6.exe 107 PID 2824 wrote to memory of 1664 2824 2d257873ee0ae75c9b89bd340e3e3da6.exe 107 PID 1664 wrote to memory of 5016 1664 cmd.exe 110 PID 1664 wrote to memory of 5016 1664 cmd.exe 110 PID 1664 wrote to memory of 5016 1664 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d257873ee0ae75c9b89bd340e3e3da6.exe"C:\Users\Admin\AppData\Local\Temp\2d257873ee0ae75c9b89bd340e3e3da6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 4522⤵
- Program crash
PID:1540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7642⤵
- Program crash
PID:3332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7722⤵
- Program crash
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7842⤵
- Program crash
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 8362⤵
- Program crash
PID:1432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 9282⤵
- Program crash
PID:3188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 9282⤵
- Program crash
PID:4592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 11122⤵
- Program crash
PID:1340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 13682⤵
- Program crash
PID:2840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2d257873ee0ae75c9b89bd340e3e3da6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2d257873ee0ae75c9b89bd340e3e3da6.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2d257873ee0ae75c9b89bd340e3e3da6.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 13962⤵
- Program crash
PID:3880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2824 -ip 28241⤵PID:4272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2824 -ip 28241⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2824 -ip 28241⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2824 -ip 28241⤵PID:3828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2824 -ip 28241⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2824 -ip 28241⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2824 -ip 28241⤵PID:3380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2824 -ip 28241⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2824 -ip 28241⤵PID:1768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2824 -ip 28241⤵PID:4352