Analysis
-
max time kernel
134s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 18:20
Static task
static1
Behavioral task
behavioral1
Sample
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe
Resource
win7-20240508-en
General
-
Target
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe
-
Size
363KB
-
MD5
09869caa0d0ca2c790201062ebfc0d84
-
SHA1
f8b2f174c356813ec14412f14dc632d6db0db5b5
-
SHA256
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24
-
SHA512
44780226c65e77bea490a8a4c6b30f8687dadd305c76cae875df3a3b94f68793e9fb6694d9eb92344700889aa2e34585c90ecbed5ab53f203b1035b245a079dc
-
SSDEEP
6144:Bl9/M+KgrbX4AbZdbr36i3DQSCV9VjqsB:39/fbXTbXhDQS09VjvB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 60 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 512 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4200 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4616 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 4000 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 1404 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 3752 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 1852 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe 848 2668 WerFault.exe 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3960 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3960 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.execmd.exedescription pid process target process PID 2668 wrote to memory of 2540 2668 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 2668 wrote to memory of 2540 2668 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 2668 wrote to memory of 2540 2668 09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe cmd.exe PID 2540 wrote to memory of 3960 2540 cmd.exe taskkill.exe PID 2540 wrote to memory of 3960 2540 cmd.exe taskkill.exe PID 2540 wrote to memory of 3960 2540 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe"C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 13642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "09e7490114ee50412cbcf2bf7aacd618b7ac59c4839f2c21ccfcc4e229015a24.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2668 -ip 26681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2668 -ip 26681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-1-0x0000000002630000-0x0000000002730000-memory.dmpFilesize
1024KB
-
memory/2668-2-0x0000000002510000-0x000000000254C000-memory.dmpFilesize
240KB
-
memory/2668-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2668-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2668-7-0x0000000002510000-0x000000000254C000-memory.dmpFilesize
240KB
-
memory/2668-6-0x0000000000400000-0x0000000002377000-memory.dmpFilesize
31.5MB