Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 05:35
Static task
static1
Behavioral task
behavioral1
Sample
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe
Resource
win7-20231129-en
General
-
Target
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe
-
Size
331KB
-
MD5
31136745ef22d3b72aee0d61214f7cbf
-
SHA1
09e60cea6d80a474f54e963dce1a8649c63c4a0a
-
SHA256
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c
-
SHA512
4220fbee8d4db8020b0bfc0719c14fb7ff45dbbc49477c8a57ca4fd61bbef55c74feee07eb2067b98cf411dc16051a7cc7020838d9f21e664c5c4f5322094fc4
-
SSDEEP
3072:3teHTDxm9M3bqoATV7VmsqYM4VrmR/WvZlmpag5Y4/iqXXnZBmM5uSyJUI:deHnxiBV7VmsqYnmRO4aF4/i+XnZ8j0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2140 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2088 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2088 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.execmd.exedescription pid process target process PID 2896 wrote to memory of 2140 2896 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 2896 wrote to memory of 2140 2896 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 2896 wrote to memory of 2140 2896 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 2896 wrote to memory of 2140 2896 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 2140 wrote to memory of 2088 2140 cmd.exe taskkill.exe PID 2140 wrote to memory of 2088 2140 cmd.exe taskkill.exe PID 2140 wrote to memory of 2088 2140 cmd.exe taskkill.exe PID 2140 wrote to memory of 2088 2140 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe"C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2896-1-0x0000000002030000-0x0000000002130000-memory.dmpFilesize
1024KB
-
memory/2896-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2896-2-0x00000000002C0000-0x00000000002FC000-memory.dmpFilesize
240KB
-
memory/2896-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2896-7-0x0000000002030000-0x0000000002130000-memory.dmpFilesize
1024KB
-
memory/2896-6-0x0000000000400000-0x0000000001F9E000-memory.dmpFilesize
27.6MB