Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe
Resource
win7-20231129-en
6 signatures
300 seconds
General
-
Target
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe
-
Size
283KB
-
MD5
062be021b0337e2f22ca9d8d489b36c9
-
SHA1
c6fc350e0cc212a820e53a5edfa27293c533d2ad
-
SHA256
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9
-
SHA512
b31eaa451f247ba65a7ac59bd5fc86e1b6eda36a32b06a46ddf4c5738f382fd773829889a34e46de751bd8d2281dd45b348ddad38eb337d6aed68ff2e3c1fb6b
-
SSDEEP
3072:WZen08ICS6qlZk2CcoyZ/bwsvJD4TswKYOlPFPwc4Mg8lhtG5jgdKOnc:30BkNc7/Uud4TJalP1bgg0gdK
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Deletes itself 1 IoCs
pid Process 2044 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2204 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2204 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2044 1684 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 28 PID 1684 wrote to memory of 2044 1684 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 28 PID 1684 wrote to memory of 2044 1684 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 28 PID 1684 wrote to memory of 2044 1684 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 28 PID 2044 wrote to memory of 2204 2044 cmd.exe 30 PID 2044 wrote to memory of 2204 2044 cmd.exe 30 PID 2044 wrote to memory of 2204 2044 cmd.exe 30 PID 2044 wrote to memory of 2204 2044 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe"C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-