Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe
Resource
win10v2004-20240419-en
General
-
Target
16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe
-
Size
300KB
-
MD5
8f95828ed2d935d8bdf5a89a766584cb
-
SHA1
cbe3852fdf629aa206e2150c6436d35adec77d3a
-
SHA256
16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399
-
SHA512
d9beb9e9539cbbdae97202a80febe807a57c965d2065e1cb5e5bc94cff67cd7307b71ccc7f6471baa8488a61b48b3263acb79b8ceaa6bac7cb5df4668948c8db
-
SSDEEP
3072:/2j6aBFkY9RpxeXFwtVqFt8+dGQhSW4vMqaMW+2AlWk0E+L2xyG69ekkbnoQwbMW:/29qa4t8rG5qrWnAl6JG68noQSMnV6a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2504 2184 WerFault.exe 77 4268 2184 WerFault.exe 77 2920 2184 WerFault.exe 77 4524 2184 WerFault.exe 77 3088 2184 WerFault.exe 77 4516 2184 WerFault.exe 77 2404 2184 WerFault.exe 77 2972 2184 WerFault.exe 77 -
Kills process with taskkill 1 IoCs
pid Process 2116 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2116 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1528 2184 16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe 93 PID 2184 wrote to memory of 1528 2184 16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe 93 PID 2184 wrote to memory of 1528 2184 16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe 93 PID 1528 wrote to memory of 2116 1528 cmd.exe 96 PID 1528 wrote to memory of 2116 1528 cmd.exe 96 PID 1528 wrote to memory of 2116 1528 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe"C:\Users\Admin\AppData\Local\Temp\16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 7722⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 8122⤵
- Program crash
PID:4268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 8082⤵
- Program crash
PID:2920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 8442⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 9762⤵
- Program crash
PID:3088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10602⤵
- Program crash
PID:4516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 14402⤵
- Program crash
PID:2404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "16ad075def11aacc92cf7eb9a1541c6472e3b7276ad9c5e1e182659d688ac399.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 13522⤵
- Program crash
PID:2972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2184 -ip 21841⤵PID:3272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2184 -ip 21841⤵PID:3276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2184 -ip 21841⤵PID:1552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2184 -ip 21841⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2184 -ip 21841⤵PID:4804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2184 -ip 21841⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2184 -ip 21841⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2184 -ip 21841⤵PID:4772