Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe
Resource
win7-20231129-en
General
-
Target
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe
-
Size
259KB
-
MD5
c1664a27283f43a4f91dde80f52adc9e
-
SHA1
618fd68f461522db5ff1157f1b8c4da72056274b
-
SHA256
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9
-
SHA512
5a669a261d2c8c0a2051dd462726f2f43f207f32e29812268b55f074bb7c9c22da2b53581803df212913daea3f85287512b76ceb17dc134266f7e2f28fd8d4fd
-
SSDEEP
3072:OIAQeTJjrld/qVXC3qNlXrOoLj5t0dMkU9vfI2zuhw358X/v4QgEPB45:OIeTeXoqNBCoLj/03SvfI2q+3ePvSQ
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3040 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2648 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2648 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.execmd.exedescription pid process target process PID 824 wrote to memory of 3040 824 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe cmd.exe PID 824 wrote to memory of 3040 824 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe cmd.exe PID 824 wrote to memory of 3040 824 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe cmd.exe PID 824 wrote to memory of 3040 824 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe cmd.exe PID 3040 wrote to memory of 2648 3040 cmd.exe taskkill.exe PID 3040 wrote to memory of 2648 3040 cmd.exe taskkill.exe PID 3040 wrote to memory of 2648 3040 cmd.exe taskkill.exe PID 3040 wrote to memory of 2648 3040 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe"C:\Users\Admin\AppData\Local\Temp\1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-1-0x0000000002020000-0x0000000002120000-memory.dmpFilesize
1024KB
-
memory/824-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/824-2-0x00000000002C0000-0x00000000002FC000-memory.dmpFilesize
240KB
-
memory/824-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/824-7-0x0000000002020000-0x0000000002120000-memory.dmpFilesize
1024KB
-
memory/824-6-0x0000000000400000-0x0000000001F8C000-memory.dmpFilesize
27.5MB