Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 07:15
Static task
static1
Behavioral task
behavioral1
Sample
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe
Resource
win10v2004-20240426-en
General
-
Target
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe
-
Size
300KB
-
MD5
15724c5ce70b274067ff07ca2abe4675
-
SHA1
014222c909bb3d681a3c391df7290483a016c9b3
-
SHA256
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858
-
SHA512
b89213c9ac96d1b2d8ce7b3c31b7f32c9ed6f4e371f5dcab1722aeeca198fbb40eb2d8c5feb0d383be316cc0724defcc5b354c91c8c5d0f2a44c50ff2c39da3f
-
SSDEEP
3072:dBd8DuuUsfIhpLQNMYPiu8+nnBu8c9SlkJAO7MTCIA3+aguivBz1jyOhpyjndo:dBjjN8Z8mAxeDWSvBz1O6a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 5064 5052 WerFault.exe 81 4476 5052 WerFault.exe 81 532 5052 WerFault.exe 81 912 5052 WerFault.exe 81 1176 5052 WerFault.exe 81 2916 5052 WerFault.exe 81 3636 5052 WerFault.exe 81 2820 5052 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 4876 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4876 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4636 5052 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 102 PID 5052 wrote to memory of 4636 5052 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 102 PID 5052 wrote to memory of 4636 5052 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 102 PID 4636 wrote to memory of 4876 4636 cmd.exe 106 PID 4636 wrote to memory of 4876 4636 cmd.exe 106 PID 4636 wrote to memory of 4876 4636 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe"C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 7402⤵
- Program crash
PID:5064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 7802⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 8162⤵
- Program crash
PID:532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 8642⤵
- Program crash
PID:912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 9042⤵
- Program crash
PID:1176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 9802⤵
- Program crash
PID:2916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 13562⤵
- Program crash
PID:3636
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 13042⤵
- Program crash
PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5052 -ip 50521⤵PID:3896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5052 -ip 50521⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5052 -ip 50521⤵PID:3752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5052 -ip 50521⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5052 -ip 50521⤵PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5052 -ip 50521⤵PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5052 -ip 50521⤵PID:1400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5052 -ip 50521⤵PID:4504