Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:11
Static task
static1
Behavioral task
behavioral1
Sample
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe
Resource
win10v2004-20240426-en
General
-
Target
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe
-
Size
256KB
-
MD5
7f95cb73c7461249b368b94fea1c8f1b
-
SHA1
2f14dbcf8706641395185bebbf2a40a79ec39db1
-
SHA256
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178
-
SHA512
cf8bde8d7d15fde2b17683958697127d5f48552b00a2e59c92172744e064d298fe1b4cbd488b5c82dec6aec99c130d6b6c685ac943f089f13e54dc2302cd8054
-
SSDEEP
3072:omFPyC+87p6q+eJaYn32/Xai8KZzyTLcXaRVMY5VR2bf:pP97Eq1JaY2DNkLcXaz6
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3820 3872 WerFault.exe 83 2060 3872 WerFault.exe 83 2896 3872 WerFault.exe 83 2648 3872 WerFault.exe 83 1304 3872 WerFault.exe 83 3276 3872 WerFault.exe 83 4696 3872 WerFault.exe 83 4124 3872 WerFault.exe 83 -
Kills process with taskkill 1 IoCs
pid Process 2212 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2212 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3872 wrote to memory of 1436 3872 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 107 PID 3872 wrote to memory of 1436 3872 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 107 PID 3872 wrote to memory of 1436 3872 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 107 PID 1436 wrote to memory of 2212 1436 cmd.exe 111 PID 1436 wrote to memory of 2212 1436 cmd.exe 111 PID 1436 wrote to memory of 2212 1436 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe"C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 7402⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 7602⤵
- Program crash
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 7602⤵
- Program crash
PID:2896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 8242⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 9042⤵
- Program crash
PID:1304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 9802⤵
- Program crash
PID:3276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 13402⤵
- Program crash
PID:4696
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 14642⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3872 -ip 38721⤵PID:2620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3872 -ip 38721⤵PID:3708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3872 -ip 38721⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3872 -ip 38721⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3872 -ip 38721⤵PID:656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3872 -ip 38721⤵PID:4604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3872 -ip 38721⤵PID:4568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3872 -ip 38721⤵PID:3808