Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe
Resource
win10v2004-20240508-en
General
-
Target
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe
-
Size
275KB
-
MD5
384651495c8919b75a6c25482f1ea43f
-
SHA1
d9cdebb9ceb4ed73c14f4cfba4f2e034f351fd2e
-
SHA256
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04
-
SHA512
ffe0e414b3cca1d35405f9aa7bfe50e0145a1d5b490aba39d18f602b2bc063be160b2927325c486a7c2e031c4875561a69cc6f12e4b899afc63fe0eb66468d43
-
SSDEEP
6144:oJzN04wtrYIvpPomtCNb0U61tjzcLPVjM2wtlz:EN07trYmHUx56PjzcLd42wz
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2204 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 2156 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3632 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 4100 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 4536 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 1712 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 588 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3008 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 2364 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 1904 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 2092 3916 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1724 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1724 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.execmd.exedescription pid process target process PID 3916 wrote to memory of 3940 3916 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 3916 wrote to memory of 3940 3916 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 3916 wrote to memory of 3940 3916 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 3940 wrote to memory of 1724 3940 cmd.exe taskkill.exe PID 3940 wrote to memory of 1724 3940 cmd.exe taskkill.exe PID 3940 wrote to memory of 1724 3940 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe"C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 4682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 5162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 10722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 13642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 13122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3916 -ip 39161⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1748,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3916 -ip 39161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3916-1-0x0000000002EB0000-0x0000000002FB0000-memory.dmpFilesize
1024KB
-
memory/3916-2-0x0000000002E10000-0x0000000002E4C000-memory.dmpFilesize
240KB
-
memory/3916-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3916-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3916-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB