Analysis
-
max time kernel
90s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe
-
Size
334KB
-
MD5
1ad55d8e91e9ba2a0f18a2d5d091f16b
-
SHA1
34863aec662d7ca5ba98d36713a1ebb5ee7ab971
-
SHA256
dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96
-
SHA512
c505cf71ac5b6f394908bb385e14befac9c84a8da43741dc71ef98d7bd3059aaa0da829929763ed2a31434bb1d1a5f79ec505184df86c62f26c28856d0616073
-
SSDEEP
6144:EULP6HF/aG9hYWwoOCI+AIBd5JQsPTnnor0rkuT:d76HF/aehhgtmzpnnKikm
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 952 5000 WerFault.exe 77 3012 5000 WerFault.exe 77 4792 5000 WerFault.exe 77 3976 5000 WerFault.exe 77 4432 5000 WerFault.exe 77 1384 5000 WerFault.exe 77 2716 5000 WerFault.exe 77 3824 5000 WerFault.exe 77 -
Kills process with taskkill 1 IoCs
pid Process 3544 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3544 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5000 wrote to memory of 4952 5000 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 93 PID 5000 wrote to memory of 4952 5000 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 93 PID 5000 wrote to memory of 4952 5000 dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe 93 PID 4952 wrote to memory of 3544 4952 cmd.exe 97 PID 4952 wrote to memory of 3544 4952 cmd.exe 97 PID 4952 wrote to memory of 3544 4952 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe"C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 7722⤵
- Program crash
PID:952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 7802⤵
- Program crash
PID:3012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 7802⤵
- Program crash
PID:4792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 8642⤵
- Program crash
PID:3976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 9762⤵
- Program crash
PID:4432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 10602⤵
- Program crash
PID:1384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 14082⤵
- Program crash
PID:2716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "dfb9b48df46acda553e8a35316d9e3b612a067ed79811450ed1ce0553f83be96.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 14522⤵
- Program crash
PID:3824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 50001⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5000 -ip 50001⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5000 -ip 50001⤵PID:568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5000 -ip 50001⤵PID:3216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5000 -ip 50001⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5000 -ip 50001⤵PID:4076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5000 -ip 50001⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5000 -ip 50001⤵PID:2848