Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 00:20
Static task
static1
Behavioral task
behavioral1
Sample
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe
Resource
win10v2004-20240426-en
General
-
Target
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe
-
Size
256KB
-
MD5
4ebd2038d23497438a5122fd6f0459f4
-
SHA1
569f528fb08b9033d2dc76c6fb343e8d15008e76
-
SHA256
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22
-
SHA512
29a0b925eea6920038ea028bffde7552aaaa897660bf9d0aed1a7ba000a058fc34d75024c0b3c187bab4664796e96ebffed9bdf8ef1f5c5fe0c109661cd8fffe
-
SSDEEP
3072:i7dXQWfAyPq7LXIZEU+AGQhSN823wPYmPfXbWkdOOy1Gu7zPw/TAolq5xrpu5uML:54WUWGIT7mP/b9Hsz43aWu1T
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 4816 4880 WerFault.exe 82 3292 4880 WerFault.exe 82 1176 4880 WerFault.exe 82 3068 4880 WerFault.exe 82 3532 4880 WerFault.exe 82 2824 4880 WerFault.exe 82 4948 4880 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 896 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 896 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4880 wrote to memory of 1644 4880 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 104 PID 4880 wrote to memory of 1644 4880 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 104 PID 4880 wrote to memory of 1644 4880 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 104 PID 1644 wrote to memory of 896 1644 cmd.exe 106 PID 1644 wrote to memory of 896 1644 cmd.exe 106 PID 1644 wrote to memory of 896 1644 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe"C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 7402⤵
- Program crash
PID:4816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 7482⤵
- Program crash
PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 7482⤵
- Program crash
PID:1176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 7602⤵
- Program crash
PID:3068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 9042⤵
- Program crash
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 10042⤵
- Program crash
PID:2824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 13402⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 48801⤵PID:1748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4880 -ip 48801⤵PID:3956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4880 -ip 48801⤵PID:2168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4880 -ip 48801⤵PID:3468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4880 -ip 48801⤵PID:4168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4880 -ip 48801⤵PID:736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4880 -ip 48801⤵PID:4924