Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 07:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe
-
Size
300KB
-
MD5
15724c5ce70b274067ff07ca2abe4675
-
SHA1
014222c909bb3d681a3c391df7290483a016c9b3
-
SHA256
f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858
-
SHA512
b89213c9ac96d1b2d8ce7b3c31b7f32c9ed6f4e371f5dcab1722aeeca198fbb40eb2d8c5feb0d383be316cc0724defcc5b354c91c8c5d0f2a44c50ff2c39da3f
-
SSDEEP
3072:dBd8DuuUsfIhpLQNMYPiu8+nnBu8c9SlkJAO7MTCIA3+aguivBz1jyOhpyjndo:dBjjN8Z8mAxeDWSvBz1O6a
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2820 3024 WerFault.exe 79 2548 3024 WerFault.exe 79 1096 3024 WerFault.exe 79 5104 3024 WerFault.exe 79 4084 3024 WerFault.exe 79 1300 3024 WerFault.exe 79 748 3024 WerFault.exe 79 3084 3024 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 2920 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2920 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1104 3024 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 97 PID 3024 wrote to memory of 1104 3024 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 97 PID 3024 wrote to memory of 1104 3024 f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe 97 PID 1104 wrote to memory of 2920 1104 cmd.exe 100 PID 1104 wrote to memory of 2920 1104 cmd.exe 100 PID 1104 wrote to memory of 2920 1104 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe"C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 7722⤵
- Program crash
PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8122⤵
- Program crash
PID:2548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8002⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8642⤵
- Program crash
PID:5104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9762⤵
- Program crash
PID:4084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 10762⤵
- Program crash
PID:1300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 14442⤵
- Program crash
PID:748
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f15892931a890cb8f1e588a8fcfc42e1fa03fb822ec7f34b6795328caa9dc858.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 13602⤵
- Program crash
PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3024 -ip 30241⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3024 -ip 30241⤵PID:3108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3024 -ip 30241⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3024 -ip 30241⤵PID:3332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3024 -ip 30241⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3024 -ip 30241⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3024 -ip 30241⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3024 -ip 30241⤵PID:4696