Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe
Resource
win10v2004-20240419-en
General
-
Target
8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe
-
Size
255KB
-
MD5
3b9ea4cda95c0b832ec39ba33525fe31
-
SHA1
3e2ee690c2d776c4781206aefa07cfe2733fe057
-
SHA256
8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c
-
SHA512
c8a76ac9add73ae0ef254b7c66c4201eb22fdb62a6f8a7acd36e1a400543342a6c5136abe1fa42e57f8b29af5442528a2983f9616961d2d3734420af48eee155
-
SSDEEP
3072:La0IQK7LrwRLjkyURA32415I8fWYzw6bmkm/YbBWK1005RA20q2m:zID76kybm2dfxDbZm/YVWL20
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 4296 4756 WerFault.exe 83 3644 4756 WerFault.exe 83 4676 4756 WerFault.exe 83 3528 4756 WerFault.exe 83 1096 4756 WerFault.exe 83 2256 4756 WerFault.exe 83 4492 4756 WerFault.exe 83 1076 4756 WerFault.exe 83 4328 4756 WerFault.exe 83 -
Kills process with taskkill 1 IoCs
pid Process 4288 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4288 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4616 4756 8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe 114 PID 4756 wrote to memory of 4616 4756 8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe 114 PID 4756 wrote to memory of 4616 4756 8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe 114 PID 4616 wrote to memory of 4288 4616 cmd.exe 118 PID 4616 wrote to memory of 4288 4616 cmd.exe 118 PID 4616 wrote to memory of 4288 4616 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe"C:\Users\Admin\AppData\Local\Temp\8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7402⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7682⤵
- Program crash
PID:3644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7962⤵
- Program crash
PID:4676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 8322⤵
- Program crash
PID:3528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 9042⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 9802⤵
- Program crash
PID:2256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 9042⤵
- Program crash
PID:4492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 13522⤵
- Program crash
PID:1076
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "8f66852578c88b98fc67cc45d2892c29f21650dab638e6a9a877de0286c7aa3c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 14442⤵
- Program crash
PID:4328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4756 -ip 47561⤵PID:536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4756 -ip 47561⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4756 -ip 47561⤵PID:3680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 47561⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4756 -ip 47561⤵PID:3308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4756 -ip 47561⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4756 -ip 47561⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4756 -ip 47561⤵PID:3776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4756 -ip 47561⤵PID:3804