Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe
-
Size
301KB
-
MD5
6c48223d8fa432c1b8e8fe1889fb9c14
-
SHA1
7efbdb0fb12a0a657d7de775636ee3fc23dd6b31
-
SHA256
ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0
-
SHA512
189e5aa4d36b495580024c416da1bad3ac3399195bda2dbcd2350da23f7b82e932025010f958d10e8196eeb2973781fe95ddf221f68ded57374f5af8ff48efa7
-
SSDEEP
6144:+4V9+1MlmH3IGEOoxH1X+82al3EvS3buM:+4V01MEXCOo1YfalQS3b
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2900 4028 WerFault.exe 78 3476 4028 WerFault.exe 78 3912 4028 WerFault.exe 78 3340 4028 WerFault.exe 78 3696 4028 WerFault.exe 78 1224 4028 WerFault.exe 78 2848 4028 WerFault.exe 78 2164 4028 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 3240 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3240 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4028 wrote to memory of 2200 4028 ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe 96 PID 4028 wrote to memory of 2200 4028 ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe 96 PID 4028 wrote to memory of 2200 4028 ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe 96 PID 2200 wrote to memory of 3240 2200 cmd.exe 99 PID 2200 wrote to memory of 3240 2200 cmd.exe 99 PID 2200 wrote to memory of 3240 2200 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe"C:\Users\Admin\AppData\Local\Temp\ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 7722⤵
- Program crash
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 8122⤵
- Program crash
PID:3476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 8522⤵
- Program crash
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 7722⤵
- Program crash
PID:3340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 9762⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 10762⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 14442⤵
- Program crash
PID:2848
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ff1e3a8e37987c9969d99b704c952cd2b95bc490a5a17ec06c15e2eda103f3f0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 13882⤵
- Program crash
PID:2164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4028 -ip 40281⤵PID:2308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4028 -ip 40281⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4028 -ip 40281⤵PID:2908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4028 -ip 40281⤵PID:3656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4028 -ip 40281⤵PID:3892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4028 -ip 40281⤵PID:2116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4028 -ip 40281⤵PID:4812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4028 -ip 40281⤵PID:2000