Analysis
-
max time kernel
134s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe
Resource
win10v2004-20240426-en
General
-
Target
b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe
-
Size
367KB
-
MD5
bff6423740c8b46aab327108a05c2753
-
SHA1
167b1a96867aadfaee6093d89dcdf095745339c6
-
SHA256
b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff
-
SHA512
b24ca5f68c96543e41f02566cc8e826cf4d756cbcf896947cf47dd4d5841ec50f760c3962a80f96de3826988c14ec274a9c021b22ecbc37ce0bc1f36cd16c452
-
SSDEEP
3072:1LjTho9/yTx0aB2LkTkLta8GRpd7hSGnAmt3bUFLsVR/p9pGu5cyIlU0:1LjThwQxZ2Lkg5mrNSUq+p96s
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
pid pid_target Process procid_target 1524 1840 WerFault.exe 81 2064 1840 WerFault.exe 81 2360 1840 WerFault.exe 81 3572 1840 WerFault.exe 81 3084 1840 WerFault.exe 81 228 1840 WerFault.exe 81 4108 1840 WerFault.exe 81 1856 1840 WerFault.exe 81 2600 1840 WerFault.exe 81 3688 1840 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 388 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 388 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2500 1840 b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe 110 PID 1840 wrote to memory of 2500 1840 b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe 110 PID 1840 wrote to memory of 2500 1840 b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe 110 PID 2500 wrote to memory of 388 2500 cmd.exe 114 PID 2500 wrote to memory of 388 2500 cmd.exe 114 PID 2500 wrote to memory of 388 2500 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe"C:\Users\Admin\AppData\Local\Temp\b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 4522⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 7642⤵
- Program crash
PID:2064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 7722⤵
- Program crash
PID:2360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 7722⤵
- Program crash
PID:3572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 7842⤵
- Program crash
PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 9362⤵
- Program crash
PID:228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 10042⤵
- Program crash
PID:4108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 10962⤵
- Program crash
PID:1856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 13762⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b5aa79176608e720e13929625256b2c78692d178ceb596568fde11aefda566ff.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 5082⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1840 -ip 18401⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1840 -ip 18401⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1840 -ip 18401⤵PID:2820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1840 -ip 18401⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1840 -ip 18401⤵PID:3412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1840 -ip 18401⤵PID:4364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1840 -ip 18401⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1840 -ip 18401⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1840 -ip 18401⤵PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1840 -ip 18401⤵PID:396