Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 11:08
Static task
static1
Behavioral task
behavioral1
Sample
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe
Resource
win10v2004-20240426-en
General
-
Target
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe
-
Size
293KB
-
MD5
7773dfc253110b66e3900cbf7d60898a
-
SHA1
b23932263b0ede8f4f3d0136d05578c65e6195ed
-
SHA256
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7
-
SHA512
ce28368fa44e2739ff796e64f168dcbeebe67bc2d3c3135680269b0c96393a27993c4891519d30c3565ef90cf545a8b4c68ae4457e96d4caf13da5942313a835
-
SSDEEP
6144:KD4MY2AZu7zUgW5JykNFhlaFK1DbuoG7WLtwT:KDy9Zu0gsBGkByam
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exedescription pid process target process PID 2208 set thread context of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3204 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3204 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exead1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.execmd.exedescription pid process target process PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 2208 wrote to memory of 4264 2208 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe PID 4264 wrote to memory of 1996 4264 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe cmd.exe PID 4264 wrote to memory of 1996 4264 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe cmd.exe PID 4264 wrote to memory of 1996 4264 ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe cmd.exe PID 1996 wrote to memory of 3204 1996 cmd.exe taskkill.exe PID 1996 wrote to memory of 3204 1996 cmd.exe taskkill.exe PID 1996 wrote to memory of 3204 1996 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe"C:\Users\Admin\AppData\Local\Temp\ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe"C:\Users\Admin\AppData\Local\Temp\ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ad1448677eac1359fe87f0086c2dc8f5865cb32f8303952a1d49ceea400934d7.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-2-0x0000000002D40000-0x0000000002E40000-memory.dmpFilesize
1024KB
-
memory/2208-3-0x00000000048C0000-0x00000000048FD000-memory.dmpFilesize
244KB
-
memory/4264-1-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4264-4-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4264-6-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4264-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4264-5-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4264-10-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB