Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
-
Size
353KB
-
MD5
a385a22c8d3f503a69bc7a534468f3c0
-
SHA1
7c67fb30ba20ea3e4357ed309a2a37064b39a652
-
SHA256
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f
-
SHA512
b5f1cb72c35410674ad4935ac84adb735c18abc0d08dac9b218ad71560f82a74cce6c6c2482516a988b39b08fcc81093106de3b0909d31d951c77e9ff3b1e486
-
SSDEEP
6144:5rlFKn40aaHZ3DbvON1aKllJb0gWjfxdJy3xC9pjKRqBQe:5ren40aIAkKp0gKpdJyk9p2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Deletes itself 1 IoCs
pid Process 2620 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2836 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2836 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2620 2972 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 2972 wrote to memory of 2620 2972 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 2972 wrote to memory of 2620 2972 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 2972 wrote to memory of 2620 2972 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 28 PID 2620 wrote to memory of 2836 2620 cmd.exe 30 PID 2620 wrote to memory of 2836 2620 cmd.exe 30 PID 2620 wrote to memory of 2836 2620 cmd.exe 30 PID 2620 wrote to memory of 2836 2620 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-