Analysis
-
max time kernel
195s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06-05-2024 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
-
Size
353KB
-
MD5
a385a22c8d3f503a69bc7a534468f3c0
-
SHA1
7c67fb30ba20ea3e4357ed309a2a37064b39a652
-
SHA256
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f
-
SHA512
b5f1cb72c35410674ad4935ac84adb735c18abc0d08dac9b218ad71560f82a74cce6c6c2482516a988b39b08fcc81093106de3b0909d31d951c77e9ff3b1e486
-
SSDEEP
6144:5rlFKn40aaHZ3DbvON1aKllJb0gWjfxdJy3xC9pjKRqBQe:5ren40aIAkKp0gKpdJyk9p2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2948 2752 WerFault.exe 72 4236 2752 WerFault.exe 72 3856 2752 WerFault.exe 72 5072 2752 WerFault.exe 72 776 2752 WerFault.exe 72 8 2752 WerFault.exe 72 5032 2752 WerFault.exe 72 4968 2752 WerFault.exe 72 -
Kills process with taskkill 1 IoCs
pid Process 716 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 716 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2752 wrote to memory of 1200 2752 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 2752 wrote to memory of 1200 2752 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 2752 wrote to memory of 1200 2752 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 82 PID 1200 wrote to memory of 716 1200 cmd.exe 84 PID 1200 wrote to memory of 716 1200 cmd.exe 84 PID 1200 wrote to memory of 716 1200 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 7682⤵
- Program crash
PID:2948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 8122⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 8442⤵
- Program crash
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 8842⤵
- Program crash
PID:5072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 9722⤵
- Program crash
PID:776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 10962⤵
- Program crash
PID:8
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 11282⤵
- Program crash
PID:5032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 12682⤵
- Program crash
PID:4968
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-