Analysis
-
max time kernel
135s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe
Resource
win10v2004-20240426-en
General
-
Target
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe
-
Size
290KB
-
MD5
127b9dedf0a978839deff3307314c996
-
SHA1
68ea574617a497c1a13145c05db055be694a915b
-
SHA256
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d
-
SHA512
7c3a83708309bcde01e53a5faeed39e310854a6ddaa5859a5e531b5c6baed801f37b34a960ec73906d3c619c3e46f2b1ef6664092b263f02add30430868dd5e4
-
SSDEEP
6144:RpgLdxBq9JnFp41VH3Lmb2ixf3UFSfBBUy6JFvT:yroJF21N3qb2il3UFa6yK
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3560 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 1748 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 4528 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 5048 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 3004 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 748 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 364 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 1376 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 4100 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 3848 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 2744 3224 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3824 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3824 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.execmd.exedescription pid process target process PID 3224 wrote to memory of 4988 3224 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 3224 wrote to memory of 4988 3224 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 3224 wrote to memory of 4988 3224 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 4988 wrote to memory of 3824 4988 cmd.exe taskkill.exe PID 4988 wrote to memory of 3824 4988 cmd.exe taskkill.exe PID 4988 wrote to memory of 3824 4988 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe"C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 13402⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 14362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3224 -ip 32241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3224-1-0x0000000002F90000-0x0000000003090000-memory.dmpFilesize
1024KB
-
memory/3224-2-0x0000000002F10000-0x0000000002F4C000-memory.dmpFilesize
240KB
-
memory/3224-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3224-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3224-6-0x0000000000400000-0x0000000002CA7000-memory.dmpFilesize
40.7MB