Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
Resource
win10v2004-20240508-en
General
-
Target
8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
-
Size
269KB
-
MD5
1d02dbc7a19497a739f8db843b42bd15
-
SHA1
1376cf6fc76aaed204dd9abb4f85b3e43c093bef
-
SHA256
8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8
-
SHA512
5da4137095a72d6557952591840debe07e84579101132d3e2affb4fb7defb71142603ae27995e22b449413fa5a5019e4f3dcfa998caded0b37aa3a28a03f8654
-
SSDEEP
3072:2lV142hxL8V3SuBboz7sPkhAbrHOGx0Xzmk/ujR8VE9blkWx8GiW5tsEX:2lQ2rSM7iGAbinvuN0E9gL
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exedescription pid process target process PID 2864 set thread context of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4552 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4552 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.execmd.exedescription pid process target process PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 2864 wrote to memory of 4852 2864 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe PID 4852 wrote to memory of 3740 4852 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe cmd.exe PID 4852 wrote to memory of 3740 4852 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe cmd.exe PID 4852 wrote to memory of 3740 4852 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe cmd.exe PID 3740 wrote to memory of 4552 3740 cmd.exe taskkill.exe PID 3740 wrote to memory of 4552 3740 cmd.exe taskkill.exe PID 3740 wrote to memory of 4552 3740 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2864-1-0x0000000002660000-0x0000000002760000-memory.dmpFilesize
1024KB
-
memory/2864-2-0x00000000025D0000-0x000000000260D000-memory.dmpFilesize
244KB
-
memory/4852-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4852-5-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4852-4-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4852-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4852-10-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB