Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 05:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe
Resource
win7-20240221-en
6 signatures
300 seconds
General
-
Target
c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe
-
Size
353KB
-
MD5
0afacd0776dd2ea8c6974b5733931c30
-
SHA1
f5f3abbfd7130474d3ce9b01a0263b577a7dc39f
-
SHA256
c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5
-
SHA512
c331f3e78fe4f8bf094c17253bd59006c0c63f65824b97ae8dae7c468f719f3181152e7aa537787231de7b3a70a18f428cf673e6d526c5b14fa68d1cc7c9450a
-
SSDEEP
6144:fh6YQY40//H1muVHs14q6BGrnaO9qpjKRqBQe:fhcY40/NRA6Bagp2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Deletes itself 1 IoCs
pid Process 2152 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2652 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2652 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2152 2960 c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe 28 PID 2960 wrote to memory of 2152 2960 c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe 28 PID 2960 wrote to memory of 2152 2960 c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe 28 PID 2960 wrote to memory of 2152 2960 c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe 28 PID 2152 wrote to memory of 2652 2152 cmd.exe 30 PID 2152 wrote to memory of 2652 2152 cmd.exe 30 PID 2152 wrote to memory of 2652 2152 cmd.exe 30 PID 2152 wrote to memory of 2652 2152 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe"C:\Users\Admin\AppData\Local\Temp\c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-