Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 20:55
Static task
static1
Behavioral task
behavioral1
Sample
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe
Resource
win10v2004-20240426-en
General
-
Target
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe
-
Size
293KB
-
MD5
574c0c09bd0a413ef51886f38bbc3db1
-
SHA1
fdd54adac7fa66850c788e8f9ca02efd51a5cacc
-
SHA256
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa
-
SHA512
b044bf640d02e5b17780a47b87f034319ba03dd4bd9ead8168c723118d42ae3fe239bcf23dd83d4ed6a992984159dd6eff03ffb1240712d4512db306fb66bb08
-
SSDEEP
6144:hyLAwGwTuG0EeIvqNM2pzFvieLavTPK4TOAnW5gRyQzT:0LAwdTf0Eeyqa2p5ibv7K47Qgnn
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4780 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 4376 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3092 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3216 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3344 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 1880 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 1936 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 2336 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 400 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 2508 2988 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4848 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4848 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.execmd.exedescription pid process target process PID 2988 wrote to memory of 3308 2988 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 2988 wrote to memory of 3308 2988 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 2988 wrote to memory of 3308 2988 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 3308 wrote to memory of 4848 3308 cmd.exe taskkill.exe PID 3308 wrote to memory of 4848 3308 cmd.exe taskkill.exe PID 3308 wrote to memory of 4848 3308 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe"C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 9202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 13402⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 13042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2988 -ip 29881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2988 -ip 29881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2988-1-0x0000000002CC0000-0x0000000002DC0000-memory.dmpFilesize
1024KB
-
memory/2988-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2988-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/2988-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2988-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB