Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 23:27
Static task
static1
Behavioral task
behavioral1
Sample
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe
Resource
win10v2004-20240426-en
General
-
Target
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe
-
Size
334KB
-
MD5
1ad55d8e91e9ba2a0f18a2d5d091f16b
-
SHA1
34863aec662d7ca5ba98d36713a1ebb5ee7ab971
-
SHA256
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96
-
SHA512
c505cf71ac5b6f394908bb385e14befac9c84a8da43741dc71ef98d7bd3059aaa0da829929763ed2a31434bb1d1a5f79ec505184df86c62f26c28856d0616073
-
SSDEEP
6144:EULP6HF/aG9hYWwoOCI+AIBd5JQsPTnnor0rkuT:d76HF/aehhgtmzpnnKikm
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 1176 1808 WerFault.exe 82 1744 1808 WerFault.exe 82 5004 1808 WerFault.exe 82 1980 1808 WerFault.exe 82 1296 1808 WerFault.exe 82 5112 1808 WerFault.exe 82 4772 1808 WerFault.exe 82 3028 1808 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 1168 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1168 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1808 wrote to memory of 5008 1808 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 105 PID 1808 wrote to memory of 5008 1808 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 105 PID 1808 wrote to memory of 5008 1808 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 105 PID 5008 wrote to memory of 1168 5008 cmd.exe 109 PID 5008 wrote to memory of 1168 5008 cmd.exe 109 PID 5008 wrote to memory of 1168 5008 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe"C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 7402⤵
- Program crash
PID:1176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 7802⤵
- Program crash
PID:1744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 7402⤵
- Program crash
PID:5004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 8122⤵
- Program crash
PID:1980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 9042⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 9162⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 13562⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 13042⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1808 -ip 18081⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1808 -ip 18081⤵PID:2536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1808 -ip 18081⤵PID:4104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1808 -ip 18081⤵PID:624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1808 -ip 18081⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1808 -ip 18081⤵PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1808 -ip 18081⤵PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1808 -ip 18081⤵PID:1816