Analysis
-
max time kernel
195s -
max time network
259s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe
-
Size
353KB
-
MD5
a385a22c8d3f503a69bc7a534468f3c0
-
SHA1
7c67fb30ba20ea3e4357ed309a2a37064b39a652
-
SHA256
92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f
-
SHA512
b5f1cb72c35410674ad4935ac84adb735c18abc0d08dac9b218ad71560f82a74cce6c6c2482516a988b39b08fcc81093106de3b0909d31d951c77e9ff3b1e486
-
SSDEEP
6144:5rlFKn40aaHZ3DbvON1aKllJb0gWjfxdJy3xC9pjKRqBQe:5ren40aIAkKp0gKpdJyk9p2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4640 4988 WerFault.exe 71 3000 4988 WerFault.exe 71 640 4988 WerFault.exe 71 1072 4988 WerFault.exe 71 4732 4988 WerFault.exe 71 4460 4988 WerFault.exe 71 1052 4988 WerFault.exe 71 3720 4988 WerFault.exe 71 -
Kills process with taskkill 1 IoCs
pid Process 480 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 480 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4988 wrote to memory of 1384 4988 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 81 PID 4988 wrote to memory of 1384 4988 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 81 PID 4988 wrote to memory of 1384 4988 92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe 81 PID 1384 wrote to memory of 480 1384 cmd.exe 83 PID 1384 wrote to memory of 480 1384 cmd.exe 83 PID 1384 wrote to memory of 480 1384 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 7682⤵
- Program crash
PID:4640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 8042⤵
- Program crash
PID:3000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 7482⤵
- Program crash
PID:640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 9042⤵
- Program crash
PID:1072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 9602⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 11162⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 11282⤵
- Program crash
PID:1052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 12682⤵
- Program crash
PID:3720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "92b22f2fa0b2c504bd9775047f03473badea384ac2a735957c33b2680575066f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:480
-
-