Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 12:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe
-
Size
256KB
-
MD5
1e29e4708cbb005b646eafa383e6f42c
-
SHA1
54c70263d8730ac6cf9f010b4b5536722116e9b7
-
SHA256
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524
-
SHA512
ef845ffa4a5ba8777045cb4823457aff324b034c2182a737c0ba614606db6cfc1764145a2358ef04501830a5dfee2c3daa84c27372faaa75381dca2313d49e45
-
SSDEEP
3072:25tM3GMNpMRuuuHKOJTZnSqrXss/Glmc41n5h5cz:cu3ZNMp6JTV2MpX+z
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4268 4328 WerFault.exe 79 4968 4328 WerFault.exe 79 5080 4328 WerFault.exe 79 4696 4328 WerFault.exe 79 3804 4328 WerFault.exe 79 2324 4328 WerFault.exe 79 4024 4328 WerFault.exe 79 2956 4328 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 2976 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2976 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3380 4328 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 96 PID 4328 wrote to memory of 3380 4328 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 96 PID 4328 wrote to memory of 3380 4328 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 96 PID 3380 wrote to memory of 2976 3380 cmd.exe 100 PID 3380 wrote to memory of 2976 3380 cmd.exe 100 PID 3380 wrote to memory of 2976 3380 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe"C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 7722⤵
- Program crash
PID:4268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 7922⤵
- Program crash
PID:4968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 7722⤵
- Program crash
PID:5080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 8642⤵
- Program crash
PID:4696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 9762⤵
- Program crash
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 10842⤵
- Program crash
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 13802⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 14602⤵
- Program crash
PID:2956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 43281⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4328 -ip 43281⤵PID:2384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4328 -ip 43281⤵PID:4452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4328 -ip 43281⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4328 -ip 43281⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4328 -ip 43281⤵PID:4116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4328 -ip 43281⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4328 -ip 43281⤵PID:4360