Analysis
-
max time kernel
132s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe
Resource
win10v2004-20240426-en
General
-
Target
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe
-
Size
268KB
-
MD5
d4b5defd49386b58a8eafe6560dc94d5
-
SHA1
c9492d819ce38cc74489b40cfd2fd4cd97a0b747
-
SHA256
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774
-
SHA512
7d8c8564524c278bf32c960080d40fa491ca0dddaecb06e1831c4723a4a84564b9f1165d2f5d03cc22e7a246c0b1559403c1f3b673998a7b3beebebdd38bc0a0
-
SSDEEP
3072:sn0oqvhLPtBUM952fX+D4BXVK48IA1xWJy95KbWUEc5RFcu2v:s0oEFBUw5Gc4BXYTQG0SU3F
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3372 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1648 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1280 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 3328 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 652 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 2672 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 2308 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1864 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 3800 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 3252 2544 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4556 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4556 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.execmd.exedescription pid process target process PID 2544 wrote to memory of 4296 2544 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 2544 wrote to memory of 4296 2544 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 2544 wrote to memory of 4296 2544 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 4296 wrote to memory of 4556 4296 cmd.exe taskkill.exe PID 4296 wrote to memory of 4556 4296 cmd.exe taskkill.exe PID 4296 wrote to memory of 4556 4296 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe"C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 4522⤵
- Program crash
PID:3372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 7642⤵
- Program crash
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 8002⤵
- Program crash
PID:1280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 7922⤵
- Program crash
PID:3328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 8602⤵
- Program crash
PID:652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 9282⤵
- Program crash
PID:2672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 10042⤵
- Program crash
PID:2308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 10522⤵
- Program crash
PID:1864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 13682⤵
- Program crash
PID:3800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 4922⤵
- Program crash
PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2544 -ip 25441⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2544 -ip 25441⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2544 -ip 25441⤵PID:3384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2544 -ip 25441⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2544 -ip 25441⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2544 -ip 25441⤵PID:1128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2544 -ip 25441⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2544 -ip 25441⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2544 -ip 25441⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2544 -ip 25441⤵PID:5084