Analysis
-
max time kernel
135s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe
Resource
win10v2004-20240508-en
General
-
Target
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe
-
Size
319KB
-
MD5
d030c03304a6bc22676fd347a1136608
-
SHA1
3d5c292674729a0d379b9be91f46f7169225f54c
-
SHA256
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e
-
SHA512
13110ce8c8e54b093d9598b12362184a946abe9ef1f8405a6ee89537ad426bde0a57c6d3a0fbd46f89f2fb4e36f78bd71966fb9c867f3c1701b250700e33e307
-
SSDEEP
6144:8xO8CtmKkcVXG5vqNjNe2swUwCn2KIbk7LWT:x8Ckcc5iNP7oa
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4104 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4808 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4456 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 1468 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4604 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 1156 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 824 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 2976 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 1532 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4112 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 1548 4372 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2712 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2712 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.execmd.exedescription pid process target process PID 4372 wrote to memory of 2724 4372 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 4372 wrote to memory of 2724 4372 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 4372 wrote to memory of 2724 4372 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 2724 wrote to memory of 2712 2724 cmd.exe taskkill.exe PID 2724 wrote to memory of 2712 2724 cmd.exe taskkill.exe PID 2724 wrote to memory of 2712 2724 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe"C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 4642⤵
- Program crash
PID:4104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 4802⤵
- Program crash
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7482⤵
- Program crash
PID:4456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7682⤵
- Program crash
PID:1468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7682⤵
- Program crash
PID:4604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 8202⤵
- Program crash
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 9122⤵
- Program crash
PID:824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 10002⤵
- Program crash
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 10562⤵
- Program crash
PID:1532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 13522⤵
- Program crash
PID:4112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 13162⤵
- Program crash
PID:1548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4372 -ip 43721⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4372 -ip 43721⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4372 -ip 43721⤵PID:1424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4372 -ip 43721⤵PID:3836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4372 -ip 43721⤵PID:1672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4372 -ip 43721⤵PID:1896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4372 -ip 43721⤵PID:1580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4372 -ip 43721⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4372 -ip 43721⤵PID:1268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4372 -ip 43721⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4372 -ip 43721⤵PID:3664