Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:39
Static task
static1
Behavioral task
behavioral1
Sample
085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe
Resource
win7-20240508-en
General
-
Target
085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe
-
Size
234KB
-
MD5
10ce4f27695a42574059e5fd8b342760
-
SHA1
fc96ec057a00ccfa5491e40c01bafa1249da59e9
-
SHA256
085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5
-
SHA512
0e32d8deb124ff86f37bffab0f9a052af6697764e5835938a98331661256a42ba16c702e360ca33980d799414fc5ac87ac62f547ff4d654e58f06e7b04d68b3a
-
SSDEEP
3072:De4EUm1rm8/JmSHWj3QFO0degWLz6a7w+MvC27uFlX5MvbX:1V4CSHYg4RMrClab
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 716 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 820 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 5000 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 1920 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 5036 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 744 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 4324 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 2912 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe 4696 2032 WerFault.exe 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4036 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4036 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.execmd.exedescription pid process target process PID 2032 wrote to memory of 544 2032 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe cmd.exe PID 2032 wrote to memory of 544 2032 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe cmd.exe PID 2032 wrote to memory of 544 2032 085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe cmd.exe PID 544 wrote to memory of 4036 544 cmd.exe taskkill.exe PID 544 wrote to memory of 4036 544 cmd.exe taskkill.exe PID 544 wrote to memory of 4036 544 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe"C:\Users\Admin\AppData\Local\Temp\085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 9762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 10482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 13042⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "085ad204e85d66f16ed572a61b5319d90f6047f85da6a42f07eae5229f4c79f5.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 12842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2032 -ip 20321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-1-0x0000000002480000-0x0000000002580000-memory.dmpFilesize
1024KB
-
memory/2032-3-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-2-0x0000000003F60000-0x0000000003F8D000-memory.dmpFilesize
180KB
-
memory/2032-6-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-5-0x0000000000400000-0x0000000002357000-memory.dmpFilesize
31.3MB