Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe
-
Size
256KB
-
MD5
4ebd2038d23497438a5122fd6f0459f4
-
SHA1
569f528fb08b9033d2dc76c6fb343e8d15008e76
-
SHA256
57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22
-
SHA512
29a0b925eea6920038ea028bffde7552aaaa897660bf9d0aed1a7ba000a058fc34d75024c0b3c187bab4664796e96ebffed9bdf8ef1f5c5fe0c109661cd8fffe
-
SSDEEP
3072:i7dXQWfAyPq7LXIZEU+AGQhSN823wPYmPfXbWkdOOy1Gu7zPw/TAolq5xrpu5uML:54WUWGIT7mP/b9Hsz43aWu1T
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2908 4204 WerFault.exe 77 3912 4204 WerFault.exe 77 2540 4204 WerFault.exe 77 2916 4204 WerFault.exe 77 1060 4204 WerFault.exe 77 2148 4204 WerFault.exe 77 2024 4204 WerFault.exe 77 4920 4204 WerFault.exe 77 1440 4204 WerFault.exe 77 -
Kills process with taskkill 1 IoCs
pid Process 3004 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3004 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4204 wrote to memory of 2396 4204 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 94 PID 4204 wrote to memory of 2396 4204 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 94 PID 4204 wrote to memory of 2396 4204 57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe 94 PID 2396 wrote to memory of 3004 2396 cmd.exe 98 PID 2396 wrote to memory of 3004 2396 cmd.exe 98 PID 2396 wrote to memory of 3004 2396 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe"C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 7762⤵
- Program crash
PID:2908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 7882⤵
- Program crash
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 7882⤵
- Program crash
PID:2540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 8042⤵
- Program crash
PID:2916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 9762⤵
- Program crash
PID:1060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 10602⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 14362⤵
- Program crash
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "57a4bfb9330ebe116c4de5fa598d6f39092321fde51f2e2bb42470c7969d8a22.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 13442⤵
- Program crash
PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 13922⤵
- Program crash
PID:1440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4204 -ip 42041⤵PID:916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4204 -ip 42041⤵PID:2876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4204 -ip 42041⤵PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4204 -ip 42041⤵PID:1444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4204 -ip 42041⤵PID:3852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4204 -ip 42041⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4204 -ip 42041⤵PID:2220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4204 -ip 42041⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4204 -ip 42041⤵PID:3496