Analysis
-
max time kernel
139s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364.exe
-
Size
320KB
-
MD5
093def82a4ce5a648f7222ac6a6b3f54
-
SHA1
e311ce27048f3db04072129a38b119a743f096ef
-
SHA256
2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364
-
SHA512
be39236afe8340b64360f262d6fde4477b279b9339984eb5fe3f0cbfacbfe7dc0df53d33dfa5dec2d852f65246942a163963824edd9dfc240b079277df3ded38
-
SSDEEP
6144:Ym6SXfDwiNX85wFj4o16iuhbOtq1GTzfj26AfJk:56SXfDzAL065bYhfIu
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.64.3
5.42.65.115
Signatures
-
Downloads MZ/PE file
-
Program crash 7 IoCs
pid pid_target Process procid_target 1092 4536 WerFault.exe 84 4636 4536 WerFault.exe 84 2856 4536 WerFault.exe 84 3144 4536 WerFault.exe 84 1972 4536 WerFault.exe 84 1932 4536 WerFault.exe 84 1524 4536 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364.exe"C:\Users\Admin\AppData\Local\Temp\2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364.exe"1⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 7522⤵
- Program crash
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 7522⤵
- Program crash
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 7522⤵
- Program crash
PID:2856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 8082⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 9042⤵
- Program crash
PID:1972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 9082⤵
- Program crash
PID:1932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 10802⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4536 -ip 45361⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4536 -ip 45361⤵PID:5024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4536 -ip 45361⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4536 -ip 45361⤵PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4536 -ip 45361⤵PID:988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4536 -ip 45361⤵PID:2204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4536 -ip 45361⤵PID:4072