Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 05:35
Static task
static1
Behavioral task
behavioral1
Sample
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe
Resource
win7-20231129-en
General
-
Target
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe
-
Size
331KB
-
MD5
31136745ef22d3b72aee0d61214f7cbf
-
SHA1
09e60cea6d80a474f54e963dce1a8649c63c4a0a
-
SHA256
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c
-
SHA512
4220fbee8d4db8020b0bfc0719c14fb7ff45dbbc49477c8a57ca4fd61bbef55c74feee07eb2067b98cf411dc16051a7cc7020838d9f21e664c5c4f5322094fc4
-
SSDEEP
3072:3teHTDxm9M3bqoATV7VmsqYM4VrmR/WvZlmpag5Y4/iqXXnZBmM5uSyJUI:deHnxiBV7VmsqYnmRO4aF4/i+XnZ8j0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2248 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 2776 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 3164 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 4652 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 5096 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 4496 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 3160 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 4996 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 648 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe 3636 3848 WerFault.exe ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1320 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1320 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.execmd.exedescription pid process target process PID 3848 wrote to memory of 920 3848 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 3848 wrote to memory of 920 3848 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 3848 wrote to memory of 920 3848 ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe cmd.exe PID 920 wrote to memory of 1320 920 cmd.exe taskkill.exe PID 920 wrote to memory of 1320 920 cmd.exe taskkill.exe PID 920 wrote to memory of 1320 920 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe"C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 8242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 10042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 10402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 13682⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ed78b55c8100789d04ea0bc74342778ba82a3943904f6e441b6c53b4fc99299c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 14482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3848 -ip 38481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3848-1-0x0000000002230000-0x0000000002330000-memory.dmpFilesize
1024KB
-
memory/3848-2-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3848-3-0x0000000000400000-0x0000000001F9E000-memory.dmpFilesize
27.6MB
-
memory/3848-6-0x0000000000400000-0x0000000001F9E000-memory.dmpFilesize
27.6MB
-
memory/3848-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB