Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 17:08
Static task
static1
Behavioral task
behavioral1
Sample
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe
Resource
win10v2004-20240508-en
General
-
Target
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe
-
Size
363KB
-
MD5
09869caa0d0ca2c790201062ebfc0d84
-
SHA1
f8b2f174c356813ec14412f14dc632d6db0db5b5
-
SHA256
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24
-
SHA512
44780226c65e77bea490a8a4c6b30f8687dadd305c76cae875df3a3b94f68793e9fb6694d9eb92344700889aa2e34585c90ecbed5ab53f203b1035b245a079dc
-
SSDEEP
6144:Bl9/M+KgrbX4AbZdbr36i3DQSCV9VjqsB:39/fbXTbXhDQS09VjvB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1596 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4596 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4696 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4756 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 1356 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 748 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 1468 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 2896 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4968 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 3008 4272 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1932 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1932 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.execmd.exedescription pid process target process PID 4272 wrote to memory of 4684 4272 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 4272 wrote to memory of 4684 4272 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 4272 wrote to memory of 4684 4272 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 4684 wrote to memory of 1932 4684 cmd.exe taskkill.exe PID 4684 wrote to memory of 1932 4684 cmd.exe taskkill.exe PID 4684 wrote to memory of 1932 4684 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe"C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 4482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 13642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4272 -ip 42721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4272-2-0x0000000002720000-0x000000000275C000-memory.dmpFilesize
240KB
-
memory/4272-1-0x00000000023D0000-0x00000000024D0000-memory.dmpFilesize
1024KB
-
memory/4272-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4272-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4272-7-0x0000000002720000-0x000000000275C000-memory.dmpFilesize
240KB
-
memory/4272-6-0x0000000000400000-0x0000000002377000-memory.dmpFilesize
31.5MB