Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe
-
Size
307KB
-
MD5
c7f146f503bdf42b9425ca93d07b3ac3
-
SHA1
426281ac054b17ff1eb2b685fca6a0a9694f5141
-
SHA256
a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474
-
SHA512
2040ade8548f8ab856e67cea20c2e5cc4acb3239f82704f61f0508d3417bb20e91661cfe6c31114b32201c9ccabefffedd696639a39512ddc63491c67a144b45
-
SSDEEP
6144:jGuSU/KGNi2hyN4fkq2e/icODSBM5O6wCl5lBTrkeT:CuSU/KuUN4fbHBmO6Vk2
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3412 3292 WerFault.exe 79 876 3292 WerFault.exe 79 3164 3292 WerFault.exe 79 2380 3292 WerFault.exe 79 1680 3292 WerFault.exe 79 1420 3292 WerFault.exe 79 5100 3292 WerFault.exe 79 4856 3292 WerFault.exe 79 4956 3292 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 3596 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3596 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1940 3292 a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe 98 PID 3292 wrote to memory of 1940 3292 a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe 98 PID 3292 wrote to memory of 1940 3292 a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe 98 PID 1940 wrote to memory of 3596 1940 cmd.exe 102 PID 1940 wrote to memory of 3596 1940 cmd.exe 102 PID 1940 wrote to memory of 3596 1940 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe"C:\Users\Admin\AppData\Local\Temp\a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 7722⤵
- Program crash
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 7922⤵
- Program crash
PID:876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 7922⤵
- Program crash
PID:3164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 8642⤵
- Program crash
PID:2380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 9762⤵
- Program crash
PID:1680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 10482⤵
- Program crash
PID:1420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 11242⤵
- Program crash
PID:5100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 14362⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "a9b6f9304ec87a8d43b4e444b41ff2bbf403e72926fe72e431e6252e7d0d9474.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 13882⤵
- Program crash
PID:4956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3292 -ip 32921⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3292 -ip 32921⤵PID:616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3292 -ip 32921⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3292 -ip 32921⤵PID:1236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3292 -ip 32921⤵PID:4368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3292 -ip 32921⤵PID:1304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3292 -ip 32921⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3292 -ip 32921⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3292 -ip 32921⤵PID:4156