Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inte.exe
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
General
-
Target
inte.exe
-
Size
220KB
-
MD5
cd0fd465ea4fd58cf58413dda8114989
-
SHA1
2ae37c14fa393dcbd68a57a49e3eecacf5be0b50
-
SHA256
a5f4270eed2a341acb58267cfaca48cfd25d5d5921b6f4d7e856ef4b5fd85dbe
-
SHA512
b05f3e05762a86aa672d3f4bed9dde6be4e9c946c02d18f470ee2542a1d5da1fa5eb4e6a33bffa8ba39e754e34cb53aa1accca8107aae218001c1a1110af371f
-
SSDEEP
3072:Kj9Wt0dASUNee76IR+tXe/ZHwYjpu8lULeJQ7k7wE65/:2cgUNj2DtXe/ZQKu7k7W
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2500 2600 WerFault.exe inte.exe 1912 2600 WerFault.exe inte.exe 2776 2600 WerFault.exe inte.exe 2752 2600 WerFault.exe inte.exe 1036 2600 WerFault.exe inte.exe 3664 2600 WerFault.exe inte.exe 1740 2600 WerFault.exe inte.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\inte.exe"C:\Users\Admin\AppData\Local\Temp\inte.exe"1⤵PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 7402⤵
- Program crash
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 7402⤵
- Program crash
PID:1912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 7842⤵
- Program crash
PID:2776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 8242⤵
- Program crash
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 9042⤵
- Program crash
PID:1036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 9802⤵
- Program crash
PID:3664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 7442⤵
- Program crash
PID:1740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2600 -ip 26001⤵PID:4720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2600 -ip 26001⤵PID:3240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2600 -ip 26001⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2600 -ip 26001⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2600 -ip 26001⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2600 -ip 26001⤵PID:3984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2600 -ip 26001⤵PID:1536