Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 08:27
Static task
static1
Behavioral task
behavioral1
Sample
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe
Resource
win10v2004-20240426-en
General
-
Target
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe
-
Size
292KB
-
MD5
583d46cf0de48deb8edbebb0f8ca9f2c
-
SHA1
805772046eb1bdfb6de597d54ae7c1a87d727b8e
-
SHA256
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd
-
SHA512
c2432c73196030af0332c09c688e23da9664dbcf788f17a2defd08bd731591ce2adfb1f1c652b87a003be77ee951851ecd9a8d660b8c1adc905eb4f999089e05
-
SSDEEP
6144:zKUFfHXsi/uG6/yAAkZVNsGhtLew2DD6JYiNYzcT:zKOPcip6/yAJVO0r2DDUH
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2436 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 5032 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 4356 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 4980 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 4832 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 2368 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 3392 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 516 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 2592 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 3812 2868 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2244 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2244 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.execmd.exedescription pid process target process PID 2868 wrote to memory of 4708 2868 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 2868 wrote to memory of 4708 2868 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 2868 wrote to memory of 4708 2868 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 4708 wrote to memory of 2244 4708 cmd.exe taskkill.exe PID 4708 wrote to memory of 2244 4708 cmd.exe taskkill.exe PID 4708 wrote to memory of 2244 4708 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe"C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 4482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 4722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 13122⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 14722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2868 -ip 28681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2868 -ip 28681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2868-1-0x0000000002D90000-0x0000000002E90000-memory.dmpFilesize
1024KB
-
memory/2868-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2868-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/2868-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2868-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB