Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
-
Size
353KB
-
MD5
a385a22c8d3f503a69bc7a534468f3c0
-
SHA1
7c67fb30ba20ea3e4357ed309a2a37064b39a652
-
SHA256
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f
-
SHA512
b5f1cb72c35410674ad4935ac84adb735c18abc0d08dac9b218ad71560f82a74cce6c6c2482516a988b39b08fcc81093106de3b0909d31d951c77e9ff3b1e486
-
SSDEEP
6144:5rlFKn40aaHZ3DbvON1aKllJb0gWjfxdJy3xC9pjKRqBQe:5ren40aIAkKp0gKpdJyk9p2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Deletes itself 1 IoCs
pid Process 1388 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2916 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2916 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1388 1184 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 1184 wrote to memory of 1388 1184 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 1184 wrote to memory of 1388 1184 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 1184 wrote to memory of 1388 1184 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 1388 wrote to memory of 2916 1388 cmd.exe 30 PID 1388 wrote to memory of 2916 1388 cmd.exe 30 PID 1388 wrote to memory of 2916 1388 cmd.exe 30 PID 1388 wrote to memory of 2916 1388 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-