Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe
Resource
win10v2004-20240508-en
General
-
Target
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe
-
Size
319KB
-
MD5
45298f591b293c7f4f1758856a2f492c
-
SHA1
5e0ba92446537b72eed4aef522bfb22e2ba6fbf5
-
SHA256
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b
-
SHA512
a534b17db5c016c4414c41629ab3cd0d3478b5e154e8439d93dd3b57cf5d1250f1ce6fdf2a5937ac0a2b2f3ba311b649f66bd6febba6f78dc7f7ff55a8b5cffa
-
SSDEEP
6144:9xusY2c2YKiRVL+fP4aK0CW743OZ7LWT:6s82MRFRajCW7Eoa
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4480 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 4960 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3440 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 1916 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3904 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 1880 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3784 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3064 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3472 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 2144 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 880 4292 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2392 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2392 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.execmd.exedescription pid process target process PID 4292 wrote to memory of 2712 4292 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 4292 wrote to memory of 2712 4292 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 4292 wrote to memory of 2712 4292 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 2712 wrote to memory of 2392 2712 cmd.exe taskkill.exe PID 2712 wrote to memory of 2392 2712 cmd.exe taskkill.exe PID 2712 wrote to memory of 2392 2712 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe"C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 4482⤵
- Program crash
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 4682⤵
- Program crash
PID:4960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 7482⤵
- Program crash
PID:3440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 7842⤵
- Program crash
PID:1916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 8002⤵
- Program crash
PID:3904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 8402⤵
- Program crash
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 9122⤵
- Program crash
PID:3784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 9842⤵
- Program crash
PID:3064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 10322⤵
- Program crash
PID:3472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 13362⤵
- Program crash
PID:2144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 13162⤵
- Program crash
PID:880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4292 -ip 42921⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4292 -ip 42921⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4292 -ip 42921⤵PID:2608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4292 -ip 42921⤵PID:2896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4292 -ip 42921⤵PID:676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4292 -ip 42921⤵PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4292 -ip 42921⤵PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4292 -ip 42921⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4292 -ip 42921⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4292 -ip 42921⤵PID:1564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4292 -ip 42921⤵PID:4416