Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 07:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
913508136edb1a9c093fe801a7a20833.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
913508136edb1a9c093fe801a7a20833.exe
-
Size
385KB
-
MD5
913508136edb1a9c093fe801a7a20833
-
SHA1
caff31db9b6d9eed07d9d822a5d935743e5a96ec
-
SHA256
9bbb6839b4a2abf2d8ef4685fa85e171343e909c62ead34a66da2b13259999e6
-
SHA512
119df083fcba996504ce130e454204daff88259182ed78cc251efdbc93eea7b8e766b38467621522b573146793b138a343eabb422e91f6c38cc712fcbb990cce
-
SSDEEP
6144:5P4LJiS4ARKP4Gb9EoOYwEU2lkciTlbt1bDnWqj4K8C4D:5P49iJqKPj9E3x2lkc8lTiU
Malware Config
Signatures
-
Gcleaner family
-
Program crash 8 IoCs
pid pid_target Process procid_target 3516 984 WerFault.exe 82 2124 984 WerFault.exe 82 1204 984 WerFault.exe 82 4288 984 WerFault.exe 82 4832 984 WerFault.exe 82 2220 984 WerFault.exe 82 2680 984 WerFault.exe 82 336 984 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 913508136edb1a9c093fe801a7a20833.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\913508136edb1a9c093fe801a7a20833.exe"C:\Users\Admin\AppData\Local\Temp\913508136edb1a9c093fe801a7a20833.exe"1⤵
- System Location Discovery: System Language Discovery
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7562⤵
- Program crash
PID:3516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7482⤵
- Program crash
PID:2124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7562⤵
- Program crash
PID:1204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7922⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9082⤵
- Program crash
PID:4832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9842⤵
- Program crash
PID:2220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10282⤵
- Program crash
PID:2680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7602⤵
- Program crash
PID:336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 984 -ip 9841⤵PID:536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 984 -ip 9841⤵PID:852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 984 -ip 9841⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 984 -ip 9841⤵PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 984 -ip 9841⤵PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 984 -ip 9841⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 984 -ip 9841⤵PID:3032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 984 -ip 9841⤵PID:3708