Analysis
-
max time kernel
90s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe
Resource
win10v2004-20240419-en
7 signatures
150 seconds
General
-
Target
7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe
-
Size
256KB
-
MD5
1444feb26c268de86897850c58ce6777
-
SHA1
5c6571dffd8df215f8a7aca554f433eedbbec627
-
SHA256
7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3
-
SHA512
6272d15a25ecb72ca1a438247511d823fc61ab7925f455f221265b05c0d672dcd5451949943f3e8bf37e9419c6b1a42b89d7a56a255092b10ca1a7cc5593ac65
-
SSDEEP
3072:+rPalSIeetbeU93m8KEfz47fCHftVajfHzgYc9/jNuh75SMpW6r:ua8FSi02rQwfofavzgnrNuPpW6r
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3352 1908 WerFault.exe 78 3320 1908 WerFault.exe 78 964 1908 WerFault.exe 78 2972 1908 WerFault.exe 78 2116 1908 WerFault.exe 78 3532 1908 WerFault.exe 78 1888 1908 WerFault.exe 78 1524 1908 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 1536 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1536 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2212 1908 7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe 96 PID 1908 wrote to memory of 2212 1908 7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe 96 PID 1908 wrote to memory of 2212 1908 7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe 96 PID 2212 wrote to memory of 1536 2212 cmd.exe 100 PID 2212 wrote to memory of 1536 2212 cmd.exe 100 PID 2212 wrote to memory of 1536 2212 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe"C:\Users\Admin\AppData\Local\Temp\7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 7722⤵
- Program crash
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 7922⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 8242⤵
- Program crash
PID:964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 8522⤵
- Program crash
PID:2972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 9762⤵
- Program crash
PID:2116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 10602⤵
- Program crash
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 14442⤵
- Program crash
PID:1888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7454748396e5377bddeac7cdf2ed0012a690105809f19fd725641cec489ca0c3.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 13882⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1908 -ip 19081⤵PID:3268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1908 -ip 19081⤵PID:1412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1908 -ip 19081⤵PID:1040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1908 -ip 19081⤵PID:3076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 19081⤵PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 19081⤵PID:1968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1908 -ip 19081⤵PID:3068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1908 -ip 19081⤵PID:2204