Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe
Resource
win10v2004-20240508-en
General
-
Target
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe
-
Size
380KB
-
MD5
c98b465dcff9411ba3ca035ebc55bfd4
-
SHA1
f824b8eae510d7740a497f7e776a79e45c04b20b
-
SHA256
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8
-
SHA512
a7c6b9d5413fa3f61db9ccfa642de2655f0c01b5248525816847057fe7bd6ad8f285cd09a79f6e983472cb0f6fd09d3fbacf527f58b4533bc618d818e75fe156
-
SSDEEP
6144:OOCKlZmp+Uk4OWGdljNHigSpTegb1+fHB:VCKjjUXOFijfg
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1772 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 2172 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 5096 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 4940 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 2692 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 4196 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 3624 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 4316 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 864 4084 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4036 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4036 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.execmd.exedescription pid process target process PID 4084 wrote to memory of 3304 4084 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 4084 wrote to memory of 3304 4084 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 4084 wrote to memory of 3304 4084 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 3304 wrote to memory of 4036 3304 cmd.exe taskkill.exe PID 3304 wrote to memory of 4036 3304 cmd.exe taskkill.exe PID 3304 wrote to memory of 4036 3304 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe"C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 4482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 9362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 13642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4084 -ip 40841⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4604,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4084 -ip 40841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4084-2-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4084-1-0x00000000024E0000-0x00000000025E0000-memory.dmpFilesize
1024KB
-
memory/4084-3-0x0000000000400000-0x000000000237B000-memory.dmpFilesize
31.5MB
-
memory/4084-6-0x0000000000400000-0x000000000237B000-memory.dmpFilesize
31.5MB
-
memory/4084-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB