Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe
Resource
win10v2004-20240226-en
General
-
Target
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe
-
Size
284KB
-
MD5
d22dd4863869e0398ac4667817757168
-
SHA1
65a78748b4321cacb529e8750be7b853a33848dc
-
SHA256
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f
-
SHA512
82b22cc22f5ac9b17763fda1a79df4309dcf37d7578c95212655fb427502c03d1630a80105229aca3d4d64407550a7db6dbbcb84f267674f5feadb09ac06743f
-
SSDEEP
6144:5LQ3SKqUtYuPWmBoZbu/WJwQs00OuqHEsqN+D5wMMKS:FgSKrtNXoZbu/WaTHOTS+9
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3776 372 WerFault.exe 84 2284 372 WerFault.exe 84 4296 372 WerFault.exe 84 4100 372 WerFault.exe 84 2188 372 WerFault.exe 84 1412 372 WerFault.exe 84 4592 372 WerFault.exe 84 1624 372 WerFault.exe 84 4196 372 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 3252 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3252 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 372 wrote to memory of 1472 372 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 109 PID 372 wrote to memory of 1472 372 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 109 PID 372 wrote to memory of 1472 372 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 109 PID 1472 wrote to memory of 3252 1472 cmd.exe 113 PID 1472 wrote to memory of 3252 1472 cmd.exe 113 PID 1472 wrote to memory of 3252 1472 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe"C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 7442⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 7602⤵
- Program crash
PID:2284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 7442⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 7802⤵
- Program crash
PID:4100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 9042⤵
- Program crash
PID:2188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 9802⤵
- Program crash
PID:1412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 10322⤵
- Program crash
PID:4592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 13402⤵
- Program crash
PID:1624
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 14642⤵
- Program crash
PID:4196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 372 -ip 3721⤵PID:764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 372 -ip 3721⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 372 -ip 3721⤵PID:3984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 372 -ip 3721⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 372 -ip 3721⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 372 -ip 3721⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 372 -ip 3721⤵PID:2316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 372 -ip 3721⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 372 -ip 3721⤵PID:936