Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/04/2024, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe
Resource
win10v2004-20240226-en
7 signatures
150 seconds
General
-
Target
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe
-
Size
284KB
-
MD5
d22dd4863869e0398ac4667817757168
-
SHA1
65a78748b4321cacb529e8750be7b853a33848dc
-
SHA256
58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f
-
SHA512
82b22cc22f5ac9b17763fda1a79df4309dcf37d7578c95212655fb427502c03d1630a80105229aca3d4d64407550a7db6dbbcb84f267674f5feadb09ac06743f
-
SSDEEP
6144:5LQ3SKqUtYuPWmBoZbu/WJwQs00OuqHEsqN+D5wMMKS:FgSKrtNXoZbu/WaTHOTS+9
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2236 3328 WerFault.exe 81 5072 3328 WerFault.exe 81 2240 3328 WerFault.exe 81 1164 3328 WerFault.exe 81 2888 3328 WerFault.exe 81 2272 3328 WerFault.exe 81 4804 3328 WerFault.exe 81 2652 3328 WerFault.exe 81 5060 3328 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 868 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 868 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3328 wrote to memory of 2220 3328 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 99 PID 3328 wrote to memory of 2220 3328 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 99 PID 3328 wrote to memory of 2220 3328 58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe 99 PID 2220 wrote to memory of 868 2220 cmd.exe 102 PID 2220 wrote to memory of 868 2220 cmd.exe 102 PID 2220 wrote to memory of 868 2220 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe"C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 7722⤵
- Program crash
PID:2236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 7802⤵
- Program crash
PID:5072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 8282⤵
- Program crash
PID:2240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 8642⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 9522⤵
- Program crash
PID:2888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 10602⤵
- Program crash
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 10922⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 14362⤵
- Program crash
PID:2652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "58f48179ed72fe25993150b8e76ed5840df24d2d8a2f44d90029f6c660d13c7f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 15442⤵
- Program crash
PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3328 -ip 33281⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3328 -ip 33281⤵PID:3028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3328 -ip 33281⤵PID:1624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3328 -ip 33281⤵PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3328 -ip 33281⤵PID:3668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3328 -ip 33281⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3328 -ip 33281⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3328 -ip 33281⤵PID:696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3328 -ip 33281⤵PID:3548