Analysis
-
max time kernel
138s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0afacd0776dd2ea8c6974b5733931c30_NEAS.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
0afacd0776dd2ea8c6974b5733931c30_NEAS.exe
-
Size
353KB
-
MD5
0afacd0776dd2ea8c6974b5733931c30
-
SHA1
f5f3abbfd7130474d3ce9b01a0263b577a7dc39f
-
SHA256
c887550a97d682bafb4bfafd001468e269a29a7c12e662e151649831b69bdbd5
-
SHA512
c331f3e78fe4f8bf094c17253bd59006c0c63f65824b97ae8dae7c468f719f3181152e7aa537787231de7b3a70a18f428cf673e6d526c5b14fa68d1cc7c9450a
-
SSDEEP
6144:fh6YQY40//H1muVHs14q6BGrnaO9qpjKRqBQe:fhcY40/NRA6Bagp2sx
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 0afacd0776dd2ea8c6974b5733931c30_NEAS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 1656 1524 WerFault.exe 84 2096 1524 WerFault.exe 84 2952 1524 WerFault.exe 84 2852 1524 WerFault.exe 84 816 1524 WerFault.exe 84 1196 1524 WerFault.exe 84 2732 1524 WerFault.exe 84 772 1524 WerFault.exe 84 736 1524 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 2248 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2840 1524 0afacd0776dd2ea8c6974b5733931c30_NEAS.exe 105 PID 1524 wrote to memory of 2840 1524 0afacd0776dd2ea8c6974b5733931c30_NEAS.exe 105 PID 1524 wrote to memory of 2840 1524 0afacd0776dd2ea8c6974b5733931c30_NEAS.exe 105 PID 2840 wrote to memory of 2248 2840 cmd.exe 109 PID 2840 wrote to memory of 2248 2840 cmd.exe 109 PID 2840 wrote to memory of 2248 2840 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afacd0776dd2ea8c6974b5733931c30_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\0afacd0776dd2ea8c6974b5733931c30_NEAS.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7402⤵
- Program crash
PID:1656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7602⤵
- Program crash
PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7602⤵
- Program crash
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7762⤵
- Program crash
PID:2852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7402⤵
- Program crash
PID:816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 9762⤵
- Program crash
PID:1196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 11522⤵
- Program crash
PID:2732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 13402⤵
- Program crash
PID:772
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0afacd0776dd2ea8c6974b5733931c30_NEAS.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0afacd0776dd2ea8c6974b5733931c30_NEAS.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0afacd0776dd2ea8c6974b5733931c30_NEAS.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 13042⤵
- Program crash
PID:736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1524 -ip 15241⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1524 -ip 15241⤵PID:2412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1524 -ip 15241⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1524 -ip 15241⤵PID:1476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1524 -ip 15241⤵PID:2528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1524 -ip 15241⤵PID:4080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1524 -ip 15241⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1524 -ip 15241⤵PID:3496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1524 -ip 15241⤵PID:4532