Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/07/2023, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe
Resource
win7-20230712-en
6 signatures
300 seconds
General
-
Target
e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe
-
Size
328KB
-
MD5
e2c4d15d52ad163feff9485adf5d577d
-
SHA1
0de8e73173ed7791250242fe1521554f38bcfd36
-
SHA256
e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa
-
SHA512
f41b5d2a54f8daa92fe7eba64df51ee71c38b94adcb829236f4517016b90845e23af74e4dedfc6ee3d986e56542afb5f20e5974eeef30d81f9a5f6e60a8758e4
-
SSDEEP
6144:GZy8qgW5ixeelIUsI4lmCfm7fpdWNgwOE/Caf:AfqgWEDlIUaIg6d0bO7W
Malware Config
Extracted
Family
gcleaner
C2
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Deletes itself 1 IoCs
pid Process 2872 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2984 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2984 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2872 1064 e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe 28 PID 1064 wrote to memory of 2872 1064 e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe 28 PID 1064 wrote to memory of 2872 1064 e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe 28 PID 1064 wrote to memory of 2872 1064 e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe 28 PID 2872 wrote to memory of 2984 2872 cmd.exe 30 PID 2872 wrote to memory of 2984 2872 cmd.exe 30 PID 2872 wrote to memory of 2984 2872 cmd.exe 30 PID 2872 wrote to memory of 2984 2872 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe"C:\Users\Admin\AppData\Local\Temp\e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-