Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 16:19
Static task
static1
Behavioral task
behavioral1
Sample
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe
Resource
win10v2004-20240426-en
General
-
Target
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe
-
Size
270KB
-
MD5
2dd4c7105c13ef07fba4aa155e081840
-
SHA1
e8d328c9e163490b0d22f781bc6fbaa481b97ad7
-
SHA256
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92
-
SHA512
53998bc7f2b227a63a559db41e2587d3e318667e1c9abeed937a10e0661bdfba1d34e70ca543ef45aa8d7311f56047cf483f61b0ed7221bca5245b578090f833
-
SSDEEP
3072:Es2Fhz52XsaRmJ+w+JkAu/heWp0gaWOsGI7b8nrvD3UD7hLSe8140QYtJqUAsZ/3:WccymjqBW65YGIsnrAX14tOMF
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3816 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 1384 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4352 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 1572 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 540 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 3892 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 2460 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 1440 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4440 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4224 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4384 2156 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2644 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2644 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.execmd.exedescription pid process target process PID 2156 wrote to memory of 2372 2156 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 2156 wrote to memory of 2372 2156 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 2156 wrote to memory of 2372 2156 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 2372 wrote to memory of 2644 2372 cmd.exe taskkill.exe PID 2372 wrote to memory of 2644 2372 cmd.exe taskkill.exe PID 2372 wrote to memory of 2644 2372 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe"C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 8362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 10282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 13842⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 13762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2156 -ip 21561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-1-0x0000000002F10000-0x0000000003010000-memory.dmpFilesize
1024KB
-
memory/2156-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/2156-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2156-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2156-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB