Analysis
-
max time kernel
136s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:56
Static task
static1
Behavioral task
behavioral1
Sample
1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe
Resource
win10v2004-20240426-en
General
-
Target
1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe
-
Size
326KB
-
MD5
24d108c845e828d6003114f825874d82
-
SHA1
d11605c79cfd0b4c75e2cf9906a437c10c34af95
-
SHA256
1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7
-
SHA512
ce4dadc5219e309ace067d0bea88f088bb445d585d0f18711108de8b800ca4949bd17d1cc16eb0f8ae3fab689133d2d1b5883b36ae49ac1f2dfc16052806fa2e
-
SSDEEP
3072:x454O4ar7l36mjhjbgh3bAC6UVQSrXskLjjiOJd5YexBy:x0l93djSh3bACFVQpkdCexB
Malware Config
Extracted
gcleaner
185.172.128.90
185.172.128.69
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2612 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 4836 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 2168 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 764 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 4396 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 4656 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 4952 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 1300 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe 1992 1780 WerFault.exe 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2688 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2688 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.execmd.exedescription pid process target process PID 1780 wrote to memory of 3472 1780 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe cmd.exe PID 1780 wrote to memory of 3472 1780 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe cmd.exe PID 1780 wrote to memory of 3472 1780 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe cmd.exe PID 3472 wrote to memory of 2688 3472 cmd.exe taskkill.exe PID 3472 wrote to memory of 2688 3472 cmd.exe taskkill.exe PID 3472 wrote to memory of 2688 3472 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe"C:\Users\Admin\AppData\Local\Temp\1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 10762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 13442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1780 -ip 17801⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1780-1-0x00000000026E0000-0x00000000027E0000-memory.dmpFilesize
1024KB
-
memory/1780-2-0x00000000024C0000-0x00000000024ED000-memory.dmpFilesize
180KB
-
memory/1780-3-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-6-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-5-0x0000000000400000-0x000000000236E000-memory.dmpFilesize
31.4MB