Analysis
-
max time kernel
196s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-05-2024 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
-
Size
353KB
-
MD5
a385a22c8d3f503a69bc7a534468f3c0
-
SHA1
7c67fb30ba20ea3e4357ed309a2a37064b39a652
-
SHA256
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f
-
SHA512
b5f1cb72c35410674ad4935ac84adb735c18abc0d08dac9b218ad71560f82a74cce6c6c2482516a988b39b08fcc81093106de3b0909d31d951c77e9ff3b1e486
-
SSDEEP
6144:5rlFKn40aaHZ3DbvON1aKllJb0gWjfxdJy3xC9pjKRqBQe:5ren40aIAkKp0gKpdJyk9p2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2232 2268 WerFault.exe 72 3140 2268 WerFault.exe 72 3180 2268 WerFault.exe 72 4008 2268 WerFault.exe 72 3444 2268 WerFault.exe 72 4140 2268 WerFault.exe 72 3644 2268 WerFault.exe 72 4388 2268 WerFault.exe 72 -
Kills process with taskkill 1 IoCs
pid Process 1040 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1040 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2944 2268 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 2268 wrote to memory of 2944 2268 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 2268 wrote to memory of 2944 2268 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 2944 wrote to memory of 1040 2944 cmd.exe 84 PID 2944 wrote to memory of 1040 2944 cmd.exe 84 PID 2944 wrote to memory of 1040 2944 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 7642⤵
- Program crash
PID:2232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 7762⤵
- Program crash
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 8642⤵
- Program crash
PID:3180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 9522⤵
- Program crash
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 9922⤵
- Program crash
PID:3444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 10962⤵
- Program crash
PID:4140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 11762⤵
- Program crash
PID:3644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 12802⤵
- Program crash
PID:4388
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-