Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/04/2024, 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe
-
Size
259KB
-
MD5
5ef4cf46165c932ee117830e7cd38ccf
-
SHA1
d45fc4a83fcd2a1fec421d55635d51bf02646d37
-
SHA256
3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7
-
SHA512
33a5d66a67e4e81b105a7ce4f4e4c82fb5d42cd8d3de4b0ac42f2cf2825b65d3699d7987ecbd323de69a7ac72227e9f934c73478c48ab9add9fa6bf7edd536be
-
SSDEEP
6144:crMgT9iXeD45U2VHSmAuLfNqeo7FGN1MFlsWY:QT9iXg45UAHJjNqeWFLc
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.115
Signatures
-
Deletes itself 1 IoCs
pid Process 3056 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2092 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2092 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1964 wrote to memory of 3056 1964 3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe 28 PID 1964 wrote to memory of 3056 1964 3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe 28 PID 1964 wrote to memory of 3056 1964 3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe 28 PID 1964 wrote to memory of 3056 1964 3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe 28 PID 3056 wrote to memory of 2092 3056 cmd.exe 30 PID 3056 wrote to memory of 2092 3056 cmd.exe 30 PID 3056 wrote to memory of 2092 3056 cmd.exe 30 PID 3056 wrote to memory of 2092 3056 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe"C:\Users\Admin\AppData\Local\Temp\3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-