Analysis
-
max time kernel
133s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe
Resource
win10v2004-20240426-en
General
-
Target
fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe
-
Size
251KB
-
MD5
cfa4a6a0f53745a8da3ebf200e704467
-
SHA1
3107c8abda139b890d4b98f27ddc41a0f3034ff4
-
SHA256
fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861
-
SHA512
84eadd94e267003b42f9f12d96bc712e9757698c4521b7107530834a69e14b49d44b2019d3f5b9a549ece15208a92159347a96863dce2713d7489958d3407361
-
SSDEEP
3072:UGRP4dODEy9Sj0rwwn9+3BgHRgvbhRAjmk+XxS9+d3ODbQsMx9N9p1nCdwst2j2C:SS3ck79hqbhRAmVxSsg4suN9vC32CmY
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3120 2224 WerFault.exe 81 4440 2224 WerFault.exe 81 3252 2224 WerFault.exe 81 4024 2224 WerFault.exe 81 348 2224 WerFault.exe 81 2424 2224 WerFault.exe 81 3904 2224 WerFault.exe 81 796 2224 WerFault.exe 81 3872 2224 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 1084 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1084 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2200 2224 fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe 110 PID 2224 wrote to memory of 2200 2224 fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe 110 PID 2224 wrote to memory of 2200 2224 fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe 110 PID 2200 wrote to memory of 1084 2200 cmd.exe 114 PID 2200 wrote to memory of 1084 2200 cmd.exe 114 PID 2200 wrote to memory of 1084 2200 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe"C:\Users\Admin\AppData\Local\Temp\fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 7402⤵
- Program crash
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 7402⤵
- Program crash
PID:4440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 7402⤵
- Program crash
PID:3252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 8362⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 9082⤵
- Program crash
PID:348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 9962⤵
- Program crash
PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 10162⤵
- Program crash
PID:3904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 13242⤵
- Program crash
PID:796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "fc351f28e8b2ed6ba6a176e4277483fb3ae15eb1b86e219510bdd92c17705861.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 13522⤵
- Program crash
PID:3872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 22241⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2224 -ip 22241⤵PID:4744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2224 -ip 22241⤵PID:760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2224 -ip 22241⤵PID:224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2224 -ip 22241⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2224 -ip 22241⤵PID:1532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2224 -ip 22241⤵PID:2316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2224 -ip 22241⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2224 -ip 22241⤵PID:4048