Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-05-2024 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe
Resource
win10v2004-20240419-en
7 signatures
150 seconds
General
-
Target
67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe
-
Size
290KB
-
MD5
4a98c98639bf8752ecdb38f1295fd605
-
SHA1
1b5aaa8e6c1c803876a267847c01b01af40810ad
-
SHA256
67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625
-
SHA512
3c1baec7d984bf9415c0c28737089f70c5d56d475f342117c517b1cb093a5715f17a103d9ec3968c84bd7709e4c8690405b30d179d57c438afc805ef1805b71f
-
SSDEEP
3072:OwV9Vhy0ynOFavDbRpk0HGIh3tPgUdonGO2r5JV1hkFTr:d/00ynYiRnHGIh3LdonGv3zhWn
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2404 3580 WerFault.exe 79 1904 3580 WerFault.exe 79 4320 3580 WerFault.exe 79 384 3580 WerFault.exe 79 3480 3580 WerFault.exe 79 3304 3580 WerFault.exe 79 1324 3580 WerFault.exe 79 3292 3580 WerFault.exe 79 1196 3580 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 1708 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1708 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3580 wrote to memory of 1040 3580 67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe 96 PID 3580 wrote to memory of 1040 3580 67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe 96 PID 3580 wrote to memory of 1040 3580 67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe 96 PID 1040 wrote to memory of 1708 1040 cmd.exe 99 PID 1040 wrote to memory of 1708 1040 cmd.exe 99 PID 1040 wrote to memory of 1708 1040 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe"C:\Users\Admin\AppData\Local\Temp\67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 7722⤵
- Program crash
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 8122⤵
- Program crash
PID:1904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 8282⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 8362⤵
- Program crash
PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 9762⤵
- Program crash
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 10602⤵
- Program crash
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 14362⤵
- Program crash
PID:1324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "67f112447b9495c7626de367e380882be8fe2280773f7716cf4fcc73fe0f6625.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 13882⤵
- Program crash
PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 15122⤵
- Program crash
PID:1196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 35801⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3580 -ip 35801⤵PID:1192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3580 -ip 35801⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3580 -ip 35801⤵PID:3068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3580 -ip 35801⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3580 -ip 35801⤵PID:2628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3580 -ip 35801⤵PID:1788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3580 -ip 35801⤵PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3580 -ip 35801⤵PID:1308