Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 09:11
Static task
static1
Behavioral task
behavioral1
Sample
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe
Resource
win10v2004-20240508-en
General
-
Target
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe
-
Size
267KB
-
MD5
b4083eecf5e10cf9fca51af2207fe512
-
SHA1
6344052f3e59e83da44adc2546dd0a102655d9fe
-
SHA256
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03
-
SHA512
8fff262307891b31460044dec1c44d5a8fd62846a70063ec01c1a5ec5bd654bcc1a8b7c66644cc87e929ed0def377d0bcf736d7d50d985b629c8077343317202
-
SSDEEP
3072:D+XdB/Z0gKFFILw6To75ScUga3BQ0H53nrCr5bxBxiiQJCm5Rq2tl4l/:uHX3wR5mx53nrCvi0boW
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4272 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 1484 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 5708 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 5640 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 2820 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 5684 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 1460 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 2600 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 5004 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 5636 4728 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5756 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 5756 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.execmd.exedescription pid process target process PID 4728 wrote to memory of 5888 4728 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 4728 wrote to memory of 5888 4728 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 4728 wrote to memory of 5888 4728 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 5888 wrote to memory of 5756 5888 cmd.exe taskkill.exe PID 5888 wrote to memory of 5756 5888 cmd.exe taskkill.exe PID 5888 wrote to memory of 5756 5888 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe"C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 4522⤵
- Program crash
PID:4272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 7642⤵
- Program crash
PID:1484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 8042⤵
- Program crash
PID:5708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 8042⤵
- Program crash
PID:5640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 7802⤵
- Program crash
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 9282⤵
- Program crash
PID:5684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 9282⤵
- Program crash
PID:1460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 10722⤵
- Program crash
PID:2600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 13482⤵
- Program crash
PID:5004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 13962⤵
- Program crash
PID:5636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4728 -ip 47281⤵PID:2424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4728 -ip 47281⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4728 -ip 47281⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4728 -ip 47281⤵PID:2764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4728 -ip 47281⤵PID:5980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4728 -ip 47281⤵PID:5544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4728 -ip 47281⤵PID:3368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4728 -ip 47281⤵PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4728 -ip 47281⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4728 -ip 47281⤵PID:184