Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe
Resource
win7-20240221-en
7 signatures
300 seconds
General
-
Target
3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe
-
Size
283KB
-
MD5
8acbbf95e37820bd8f53785ab0c9d7ae
-
SHA1
570013098ce12e8d847da0d60a3bc0cfbcc02034
-
SHA256
3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f
-
SHA512
b57448bc403198d349e989fb7bcec31e05d103fdeb02301d980025c358f32463526c2ee6d544923afc09d65aaab8c7865a6dbcbeeff9c776ffff221c41bc0adb
-
SSDEEP
3072:5ZwSXv2E3qamz7GT3QQAUK3NRdxBvjhe1WBki3Bre/ljCHfZpD5jHKOnc:DXFC7GjhDiNrvjU12I/YHBHK
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Deletes itself 1 IoCs
pid Process 3068 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1676 set thread context of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2640 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2640 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1676 wrote to memory of 1704 1676 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 28 PID 1704 wrote to memory of 3068 1704 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 29 PID 1704 wrote to memory of 3068 1704 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 29 PID 1704 wrote to memory of 3068 1704 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 29 PID 1704 wrote to memory of 3068 1704 3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe 29 PID 3068 wrote to memory of 2640 3068 cmd.exe 31 PID 3068 wrote to memory of 2640 3068 cmd.exe 31 PID 3068 wrote to memory of 2640 3068 cmd.exe 31 PID 3068 wrote to memory of 2640 3068 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe"C:\Users\Admin\AppData\Local\Temp\3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe"C:\Users\Admin\AppData\Local\Temp\3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe" & exit3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3f18dfe962d9a1e4e746283212ccb0e1d8a463df4343fb0d29648af348c4ea5f.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
-