Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 16:10
Static task
static1
Behavioral task
behavioral1
Sample
3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe
Resource
win10v2004-20240426-en
General
-
Target
3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe
-
Size
249KB
-
MD5
4fb25fd184f97b38e6a0516a03c312c5
-
SHA1
3d52c147cecc372f3f44798575b0a1bd4da99e2e
-
SHA256
3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317
-
SHA512
9a6b5f22d3b8e52b78e548f11fed0188b2bd9e369d55da5119adbe3d4f61c6b643c47229d54c7e70da10e9d05dbedb66d205985e7064221d7404fd4618d02efb
-
SSDEEP
6144:hwwIV6F0/NV9iQw4Y8W8XBvo2mkSGHZ40:hwwIV6F0VuaY8WnhGHq0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2308 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 2304 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 1788 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 2936 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 3196 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 4268 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 4668 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe 2696 1368 WerFault.exe 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2340 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2340 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.execmd.exedescription pid process target process PID 1368 wrote to memory of 2188 1368 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe cmd.exe PID 1368 wrote to memory of 2188 1368 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe cmd.exe PID 1368 wrote to memory of 2188 1368 3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe cmd.exe PID 2188 wrote to memory of 2340 2188 cmd.exe taskkill.exe PID 2188 wrote to memory of 2340 2188 cmd.exe taskkill.exe PID 2188 wrote to memory of 2340 2188 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe"C:\Users\Admin\AppData\Local\Temp\3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 13322⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3a2010afc7c66c95626684484a956d68e854b3e138498b66ceebe2c8bea74317.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 12762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1368 -ip 13681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-1-0x00000000006F0000-0x00000000007F0000-memory.dmpFilesize
1024KB
-
memory/1368-3-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1368-2-0x0000000002090000-0x00000000020BD000-memory.dmpFilesize
180KB
-
memory/1368-5-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1368-6-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB