Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe
Resource
win10v2004-20241007-en
General
-
Target
adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe
-
Size
388KB
-
MD5
b1b0f662604ad80678956c119ab3eb74
-
SHA1
08cfcb77516e6ba7e03ab99dd2c23f2af7564bc7
-
SHA256
adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d
-
SHA512
63940011f68457469ec7b942dd2db2b34c36394aafb4e5df5f48d147efee8a44f7392f4a107364c8c51c9b5254e0c5a6ca31ef7a463f4fba607c79c59b0aa9e2
-
SSDEEP
6144:2dTfwYDTggRO4bLVyEOkW6igrunVW9mcvPD93S3yxAv77ykGRDDFar:275LVyEG6i5nVW9D3D93S3yxu75GRd6
Malware Config
Extracted
gcleaner
ppp-gl.biz
45.9.20.13
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 6 IoCs
resource yara_rule behavioral2/memory/3092-2-0x00000000024D0000-0x00000000024FF000-memory.dmp family_onlylogger behavioral2/memory/3092-3-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/3092-6-0x00000000024D0000-0x00000000024FF000-memory.dmp family_onlylogger behavioral2/memory/3092-5-0x0000000000400000-0x0000000000793000-memory.dmp family_onlylogger behavioral2/memory/3092-7-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/3092-11-0x0000000000400000-0x0000000000793000-memory.dmp family_onlylogger -
Program crash 9 IoCs
pid pid_target Process procid_target 4580 3092 WerFault.exe 81 4920 3092 WerFault.exe 81 3948 3092 WerFault.exe 81 540 3092 WerFault.exe 81 3504 3092 WerFault.exe 81 1460 3092 WerFault.exe 81 2932 3092 WerFault.exe 81 2016 3092 WerFault.exe 81 4288 3092 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe"C:\Users\Admin\AppData\Local\Temp\adc6b0f79706dd9eb904164601e7d7b741c289dac80137c55b41203f07f8041d.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 6242⤵
- Program crash
PID:4580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 6322⤵
- Program crash
PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7242⤵
- Program crash
PID:3948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7722⤵
- Program crash
PID:540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 8042⤵
- Program crash
PID:3504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 8202⤵
- Program crash
PID:1460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 9122⤵
- Program crash
PID:2932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 10922⤵
- Program crash
PID:2016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 13002⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3092 -ip 30921⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3092 -ip 30921⤵PID:1380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3092 -ip 30921⤵PID:3028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3092 -ip 30921⤵PID:4804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3092 -ip 30921⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3092 -ip 30921⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3092 -ip 30921⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3092 -ip 30921⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3092 -ip 30921⤵PID:2512