Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe
Resource
win10v2004-20240508-en
General
-
Target
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe
-
Size
345KB
-
MD5
44f51057f81a176e9f8c17797190a480
-
SHA1
10e658e1cf6809be37086f97a1f55f47863705ec
-
SHA256
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26
-
SHA512
8adc6e6ab14b3804b04fa746dd4765f1246b29a15c502631b0eaee493e5ae4b69044157e98c2d51f6d5a145315a48de355273d81184351bc86c83b8f14d86dd8
-
SSDEEP
6144:YeN7gDxYwV/bJKo76+l+2oeU4L+jsLwqWwIKDH7iY3ZCizw7LDl5M:YeguwVjp4eGYLwq2KDH7JUV5M
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3240 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 5024 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 2144 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 4996 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 2860 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 4132 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1760 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1776 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 2568 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1184 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe 1360 4824 WerFault.exe da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2176 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2176 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.execmd.exedescription pid process target process PID 4824 wrote to memory of 1856 4824 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 4824 wrote to memory of 1856 4824 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 4824 wrote to memory of 1856 4824 da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe cmd.exe PID 1856 wrote to memory of 2176 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 2176 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 2176 1856 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe"C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 4602⤵
- Program crash
PID:3240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 4882⤵
- Program crash
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 7482⤵
- Program crash
PID:2144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 7682⤵
- Program crash
PID:4996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 7682⤵
- Program crash
PID:2860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 7922⤵
- Program crash
PID:4132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 9122⤵
- Program crash
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 10082⤵
- Program crash
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 11242⤵
- Program crash
PID:2568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 15762⤵
- Program crash
PID:1184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "da85eacebca676e949368088dd9518a50abece040f49dbe51f38ea9c47bb2c26.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 16962⤵
- Program crash
PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4824 -ip 48241⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4824 -ip 48241⤵PID:1468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4824 -ip 48241⤵PID:312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4824 -ip 48241⤵PID:4360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4824 -ip 48241⤵PID:2520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4824 -ip 48241⤵PID:532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4824 -ip 48241⤵PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4824 -ip 48241⤵PID:1368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4824 -ip 48241⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4824 -ip 48241⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4824 -ip 48241⤵PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99