Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe
Resource
win10v2004-20240419-en
7 signatures
150 seconds
General
-
Target
d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe
-
Size
300KB
-
MD5
41a9ce43e68a28c8d3be9d7528ac89bd
-
SHA1
720891b1e49f68d1205fac01c8b620dcc711b44f
-
SHA256
d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0
-
SHA512
1e3fa64ab904ac55f464cac636cbde6c8a9c636b54f83d80d609c38438f6678cc5c7ef595927f0f2430dd8d6ee24dd28244474ec7874ae00eae4067e1f51ad7a
-
SSDEEP
6144:nrzLyr6ikE5Zg0DzRWA2xUo8pTmwT1oVo6a:nr3yr6iVnDzRWZxMfoW6
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 1636 4896 WerFault.exe 79 3892 4896 WerFault.exe 79 1988 4896 WerFault.exe 79 2848 4896 WerFault.exe 79 3724 4896 WerFault.exe 79 1992 4896 WerFault.exe 79 2812 4896 WerFault.exe 79 4160 4896 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 4820 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4760 4896 d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe 98 PID 4896 wrote to memory of 4760 4896 d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe 98 PID 4896 wrote to memory of 4760 4896 d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe 98 PID 4760 wrote to memory of 4820 4760 cmd.exe 102 PID 4760 wrote to memory of 4820 4760 cmd.exe 102 PID 4760 wrote to memory of 4820 4760 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe"C:\Users\Admin\AppData\Local\Temp\d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 7722⤵
- Program crash
PID:1636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 7802⤵
- Program crash
PID:3892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 8402⤵
- Program crash
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 8482⤵
- Program crash
PID:2848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 9762⤵
- Program crash
PID:3724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 9802⤵
- Program crash
PID:1992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 14242⤵
- Program crash
PID:2812
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "d8d63618bdbf7026bc080aee5273c85ada6aa81fbc75da63d7393ee334f91fa0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 15202⤵
- Program crash
PID:4160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4896 -ip 48961⤵PID:4752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4896 -ip 48961⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4896 -ip 48961⤵PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4896 -ip 48961⤵PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4896 -ip 48961⤵PID:3560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4896 -ip 48961⤵PID:1048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4896 -ip 48961⤵PID:1580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4896 -ip 48961⤵PID:1528