Analysis
-
max time kernel
133s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 10:27
Static task
static1
Behavioral task
behavioral1
Sample
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe
Resource
win10v2004-20240419-en
General
-
Target
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe
-
Size
301KB
-
MD5
328e6d14f53fe92b9b92f3c33b7bfa31
-
SHA1
abaad61372698dc98ecddfa219504593390599fe
-
SHA256
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d
-
SHA512
c0e2266af63526685578201c7185f38cad05aac47da657115b0efe09c55174101b26a239b782f66cf64c06fe3a378ea8ddd392e514b74c5cfa9f1804fe80af8c
-
SSDEEP
3072:kL167ZZ4LpixjK7iJtW+EGQhSWSJyPlJzNAWFe5NoU3PlwoP4ikuKPyQ3+EaaiRt:kL5f4tWiGuuzNXyPq7yK13zaebDsW6a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 5068 2928 WerFault.exe 82 5032 2928 WerFault.exe 82 2492 2928 WerFault.exe 82 3860 2928 WerFault.exe 82 3252 2928 WerFault.exe 82 432 2928 WerFault.exe 82 720 2928 WerFault.exe 82 4512 2928 WerFault.exe 82 2516 2928 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 4596 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4596 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3468 2928 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 110 PID 2928 wrote to memory of 3468 2928 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 110 PID 2928 wrote to memory of 3468 2928 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 110 PID 3468 wrote to memory of 4596 3468 cmd.exe 114 PID 3468 wrote to memory of 4596 3468 cmd.exe 114 PID 3468 wrote to memory of 4596 3468 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe"C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 7402⤵
- Program crash
PID:5068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 7602⤵
- Program crash
PID:5032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 7762⤵
- Program crash
PID:2492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 8322⤵
- Program crash
PID:3860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 9042⤵
- Program crash
PID:3252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 10002⤵
- Program crash
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 10642⤵
- Program crash
PID:720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 13442⤵
- Program crash
PID:4512
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 13842⤵
- Program crash
PID:2516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2928 -ip 29281⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2928 -ip 29281⤵PID:3064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2928 -ip 29281⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2928 -ip 29281⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2928 -ip 29281⤵PID:3284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2928 -ip 29281⤵PID:3548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2928 -ip 29281⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2928 -ip 29281⤵PID:536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2928 -ip 29281⤵PID:3832