Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe
-
Size
256KB
-
MD5
7f95cb73c7461249b368b94fea1c8f1b
-
SHA1
2f14dbcf8706641395185bebbf2a40a79ec39db1
-
SHA256
0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178
-
SHA512
cf8bde8d7d15fde2b17683958697127d5f48552b00a2e59c92172744e064d298fe1b4cbd488b5c82dec6aec99c130d6b6c685ac943f089f13e54dc2302cd8054
-
SSDEEP
3072:omFPyC+87p6q+eJaYn32/Xai8KZzyTLcXaRVMY5VR2bf:pP97Eq1JaY2DNkLcXaz6
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4472 4188 WerFault.exe 78 1028 4188 WerFault.exe 78 1224 4188 WerFault.exe 78 2348 4188 WerFault.exe 78 984 4188 WerFault.exe 78 3716 4188 WerFault.exe 78 1052 4188 WerFault.exe 78 5008 4188 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 1316 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4188 wrote to memory of 3348 4188 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 95 PID 4188 wrote to memory of 3348 4188 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 95 PID 4188 wrote to memory of 3348 4188 0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe 95 PID 3348 wrote to memory of 1316 3348 cmd.exe 99 PID 3348 wrote to memory of 1316 3348 cmd.exe 99 PID 3348 wrote to memory of 1316 3348 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe"C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7722⤵
- Program crash
PID:4472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7922⤵
- Program crash
PID:1028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 8242⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 8522⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 9762⤵
- Program crash
PID:984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 9802⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 14362⤵
- Program crash
PID:1052
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0935260ade20fc5f2f3713b270fc88a282f98505632b7f04986441c90d4d0178.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 13922⤵
- Program crash
PID:5008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4188 -ip 41881⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4188 -ip 41881⤵PID:4148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4188 -ip 41881⤵PID:472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4188 -ip 41881⤵PID:3832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4188 -ip 41881⤵PID:2692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4188 -ip 41881⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4188 -ip 41881⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4188 -ip 41881⤵PID:1468