Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-05-2024 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe
Resource
win10v2004-20240419-en
7 signatures
150 seconds
General
-
Target
765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe
-
Size
263KB
-
MD5
c016ac06e2bd7ed6f4c5ee4d84f85bb4
-
SHA1
b773156a952dae7bcb87afc90b199b935c1db547
-
SHA256
765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd
-
SHA512
e719951ae41eb0480ecc4cce125c76f68bd32c9ba985ad0021348ca9f04da794e210c5a7e37f4447197ae2d09a3070208393fc3c42c3cb5c34f4bcc7126fdb47
-
SSDEEP
3072:GC+BTGZf3IcvdZDhr8p0iyvUKgdB5KobdYHwb5RerrpNj:hgsXlr8tyMaobdV/erl5
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4236 1960 WerFault.exe 79 1896 1960 WerFault.exe 79 2460 1960 WerFault.exe 79 5036 1960 WerFault.exe 79 1164 1960 WerFault.exe 79 1892 1960 WerFault.exe 79 2236 1960 WerFault.exe 79 3464 1960 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 4368 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4368 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1960 wrote to memory of 3388 1960 765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe 96 PID 1960 wrote to memory of 3388 1960 765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe 96 PID 1960 wrote to memory of 3388 1960 765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe 96 PID 3388 wrote to memory of 4368 3388 cmd.exe 100 PID 3388 wrote to memory of 4368 3388 cmd.exe 100 PID 3388 wrote to memory of 4368 3388 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe"C:\Users\Admin\AppData\Local\Temp\765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 7722⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 7802⤵
- Program crash
PID:1896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 8122⤵
- Program crash
PID:2460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 8442⤵
- Program crash
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 9762⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 9802⤵
- Program crash
PID:1892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 14322⤵
- Program crash
PID:2236
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "765df4920601ae8f39af0b32631559bbcad78f431395269dcb06d25e8d83f5bd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 14642⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1960 -ip 19601⤵PID:3396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1960 -ip 19601⤵PID:3052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1960 -ip 19601⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1960 -ip 19601⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1960 -ip 19601⤵PID:3776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1960 -ip 19601⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1960 -ip 19601⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1960 -ip 19601⤵PID:2040