Analysis
-
max time kernel
193s -
max time network
287s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-05-2024 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe
Resource
win7-20231129-en
6 signatures
300 seconds
General
-
Target
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe
-
Size
283KB
-
MD5
c12f4ab87416d22ac2989a1ff929e168
-
SHA1
ec58965c77662664fdacd884cfee7655d4c5fa0e
-
SHA256
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb
-
SHA512
efb6a0b669ab553cf2fd125c64886c1e0bdb1ce1c595c99f1ff809419dc54b2b6d943948bdfbf50d3e04d9174dfaf973ab35d47d8b8f3bff36fcbd9455b09bcd
-
SSDEEP
3072:wZk30AnvvcJQ4Vo8Crr599hT/UeSO6L9Lm5jHKOnc:30qvE5Voh9fT/UlO6LWHK
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4676 5044 WerFault.exe 71 3192 5044 WerFault.exe 71 1892 5044 WerFault.exe 71 864 5044 WerFault.exe 71 1500 5044 WerFault.exe 71 4160 5044 WerFault.exe 71 4144 5044 WerFault.exe 71 1132 5044 WerFault.exe 71 -
Kills process with taskkill 1 IoCs
pid Process 3400 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3400 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5044 wrote to memory of 2312 5044 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 81 PID 5044 wrote to memory of 2312 5044 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 81 PID 5044 wrote to memory of 2312 5044 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 81 PID 2312 wrote to memory of 3400 2312 cmd.exe 83 PID 2312 wrote to memory of 3400 2312 cmd.exe 83 PID 2312 wrote to memory of 3400 2312 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe"C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 7642⤵
- Program crash
PID:4676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 7722⤵
- Program crash
PID:3192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 8402⤵
- Program crash
PID:1892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 9482⤵
- Program crash
PID:864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 9682⤵
- Program crash
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 11122⤵
- Program crash
PID:4160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 11722⤵
- Program crash
PID:4144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 12642⤵
- Program crash
PID:1132
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-