Analysis
-
max time kernel
136s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 06:46
Static task
static1
Behavioral task
behavioral1
Sample
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe
Resource
win10v2004-20240426-en
General
-
Target
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe
-
Size
292KB
-
MD5
833015bd47fd3060d76975e158938b89
-
SHA1
9ca3f4dbb53be92a039504de28b57e990214ccf6
-
SHA256
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855
-
SHA512
f496d119a6b12adfd9432a1de89b95ce7c1a356b3a730967259d626e0a435b16cf5eb695a71d07818d15b165e2d562e6beddc1f2a6a286a7ff4bba738f0db8f2
-
SSDEEP
6144:bvsuT8+2J/VBz7FpAhfMzdJwkyfMUNIAWmjTFT:bvsW8+2TB3FUfMZly00jN1
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 716 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4172 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 2424 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4788 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 3564 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 5632 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4212 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 428 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 2860 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4640 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4664 4780 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4636 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4636 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.execmd.exedescription pid process target process PID 4780 wrote to memory of 4684 4780 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 4780 wrote to memory of 4684 4780 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 4780 wrote to memory of 4684 4780 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 4684 wrote to memory of 4636 4684 cmd.exe taskkill.exe PID 4684 wrote to memory of 4636 4684 cmd.exe taskkill.exe PID 4684 wrote to memory of 4636 4684 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe"C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 10202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 13522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 13042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4780 -ip 47801⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4780-1-0x0000000002F50000-0x0000000003050000-memory.dmpFilesize
1024KB
-
memory/4780-2-0x0000000002F10000-0x0000000002F4C000-memory.dmpFilesize
240KB
-
memory/4780-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4780-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4780-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB