Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe
Resource
win10v2004-20240419-en
7 signatures
150 seconds
General
-
Target
0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe
-
Size
301KB
-
MD5
b9b9c5df6cfb4b6e3a78b499393bbe1a
-
SHA1
db25b8cb8aab4feb53bb3d24430715388d8e7c58
-
SHA256
0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a
-
SHA512
7da9c39cf3889a40cfe478046101b1c0a658a07f69277d83afb5f2b5274d9096eb0f2081438e536434e109ad54acb3f0ab1e8601774baae2d87fb62b09a5b94a
-
SSDEEP
6144:UjbJYmJ3nCN7fDrazozRg+5RHU71dVOH6a:UjlYmJ3ClfaoFgqHkdVOH6
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4508 1432 WerFault.exe 76 3732 1432 WerFault.exe 76 2312 1432 WerFault.exe 76 3908 1432 WerFault.exe 76 3104 1432 WerFault.exe 76 4872 1432 WerFault.exe 76 4976 1432 WerFault.exe 76 1732 1432 WerFault.exe 76 -
Kills process with taskkill 1 IoCs
pid Process 1248 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1248 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2864 1432 0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe 92 PID 1432 wrote to memory of 2864 1432 0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe 92 PID 1432 wrote to memory of 2864 1432 0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe 92 PID 2864 wrote to memory of 1248 2864 cmd.exe 96 PID 2864 wrote to memory of 1248 2864 cmd.exe 96 PID 2864 wrote to memory of 1248 2864 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe"C:\Users\Admin\AppData\Local\Temp\0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 7722⤵
- Program crash
PID:4508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8122⤵
- Program crash
PID:3732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8322⤵
- Program crash
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8402⤵
- Program crash
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9762⤵
- Program crash
PID:3104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 10602⤵
- Program crash
PID:4872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 14282⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0db8a41ae5df009b2aaae567811b6619847a42f56523667a83efe1e71b82ee1a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 14722⤵
- Program crash
PID:1732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1432 -ip 14321⤵PID:3012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1432 -ip 14321⤵PID:1252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1432 -ip 14321⤵PID:5104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1432 -ip 14321⤵PID:4448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1432 -ip 14321⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1432 -ip 14321⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1432 -ip 14321⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1432 -ip 14321⤵PID:3472