Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 18:34
Static task
static1
Behavioral task
behavioral1
Sample
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
Resource
win7-20240508-en
General
-
Target
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
-
Size
291KB
-
MD5
626ea419b77ac93450f54c5214bca2d9
-
SHA1
b2b29599042ef12d15fff5b9f64c2a3511bdee8d
-
SHA256
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97
-
SHA512
dfc0ac10237b11e11f3bbfe1f45730e3cb5e20d3a473d3aaf098ea19650cfdade305177eb8fd5a4005d1e375d40c028b058abf8900209ebbc320445aaf8963c8
-
SSDEEP
6144:jdZ7DxHFJcxg2uBN/ctTIoAneoFKgmuzTYnT:ZxxXcxTuD/cye0KgpU
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2736 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2872 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2872 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.execmd.exedescription pid process target process PID 1768 wrote to memory of 2736 1768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 1768 wrote to memory of 2736 1768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 1768 wrote to memory of 2736 1768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 1768 wrote to memory of 2736 1768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 2736 wrote to memory of 2872 2736 cmd.exe taskkill.exe PID 2736 wrote to memory of 2872 2736 cmd.exe taskkill.exe PID 2736 wrote to memory of 2872 2736 cmd.exe taskkill.exe PID 2736 wrote to memory of 2872 2736 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872