Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 15:31
Static task
static1
Behavioral task
behavioral1
Sample
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe
Resource
win10v2004-20240426-en
General
-
Target
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe
-
Size
300KB
-
MD5
d180fd1f59df9817e5abba03edd52549
-
SHA1
f62c62d94192bbdbd805532d08c403e3b70da73b
-
SHA256
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327
-
SHA512
f900c1194f848a0974ca54d9ff04f599fd95e80912cd376ee49427cee592febe57c0c048e0e09d8201a62be627b90cf01b273437f2d7e0deebe68fe03dc86661
-
SSDEEP
3072:r/FQYRCokaTyFQUZvVrBI+BGQhSB3favGMYtl4E7mvX1y4rtlYB36H47bHwymJKP:RhStrWPGOaeMm4F1y4rct64bHw006a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4320 4588 WerFault.exe 81 2976 4588 WerFault.exe 81 1712 4588 WerFault.exe 81 4928 4588 WerFault.exe 81 2964 4588 WerFault.exe 81 3776 4588 WerFault.exe 81 624 4588 WerFault.exe 81 1188 4588 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 1420 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1420 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4588 wrote to memory of 2540 4588 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 104 PID 4588 wrote to memory of 2540 4588 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 104 PID 4588 wrote to memory of 2540 4588 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 104 PID 2540 wrote to memory of 1420 2540 cmd.exe 108 PID 2540 wrote to memory of 1420 2540 cmd.exe 108 PID 2540 wrote to memory of 1420 2540 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe"C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7402⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7402⤵
- Program crash
PID:2976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7722⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7802⤵
- Program crash
PID:4928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9082⤵
- Program crash
PID:2964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9842⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 13362⤵
- Program crash
PID:624
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9722⤵
- Program crash
PID:1188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4588 -ip 45881⤵PID:1552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4588 -ip 45881⤵PID:3892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4588 -ip 45881⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4588 -ip 45881⤵PID:2928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4588 -ip 45881⤵PID:3076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4588 -ip 45881⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4588 -ip 45881⤵PID:4168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4588 -ip 45881⤵PID:1856