Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 15:26
Static task
static1
Behavioral task
behavioral1
Sample
0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe
Resource
win10v2004-20240412-en
General
-
Target
0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe
-
Size
343KB
-
MD5
ff68d4b2e32f8969a8c8244013c07ba2
-
SHA1
0f895b1e11df2998a880a2394f9d706b5b801ffb
-
SHA256
0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9
-
SHA512
b1bd3a5eaffc6de8d31f35a277d738f07097a057627c4f33c0a878317deee1eb9481cc42cf4a88fb57d629ac3f1845e133422ed84126110b48116154b216d703
-
SSDEEP
3072:jcRftzopvPoqbd+cXJZXpA8gbhIydLczwBu8D/KxiX6PhWCoBlFtOl6VChHgtKb8:+zox3fLmhldLGcuOKxiX6ZI5C4C5Eac
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2152 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 2232 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 2952 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 3272 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 3868 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 448 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 2172 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 220 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe 5064 2888 WerFault.exe 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1588 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1588 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.execmd.exedescription pid process target process PID 2888 wrote to memory of 2768 2888 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe cmd.exe PID 2888 wrote to memory of 2768 2888 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe cmd.exe PID 2888 wrote to memory of 2768 2888 0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe cmd.exe PID 2768 wrote to memory of 1588 2768 cmd.exe taskkill.exe PID 2768 wrote to memory of 1588 2768 cmd.exe taskkill.exe PID 2768 wrote to memory of 1588 2768 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe"C:\Users\Admin\AppData\Local\Temp\0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 7322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 9802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 13402⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0b6a021e9e60874928a025b0f41219888a955c5f329894e8d740080ed6b4fdc9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 13202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2888 -ip 28881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2888-1-0x00000000040A0000-0x00000000041A0000-memory.dmpFilesize
1024KB
-
memory/2888-2-0x0000000005C60000-0x0000000005C8D000-memory.dmpFilesize
180KB
-
memory/2888-4-0x0000000000400000-0x0000000004049000-memory.dmpFilesize
60.3MB
-
memory/2888-5-0x0000000005C60000-0x0000000005C8D000-memory.dmpFilesize
180KB