Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe
Resource
win7-20240419-en
1 signatures
150 seconds
General
-
Target
b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe
-
Size
332KB
-
MD5
2ca7d4b9098f5255bceaa813e12bacbd
-
SHA1
353bb8d3525ec8d258ee22aba76a53f75a2c9bf6
-
SHA256
b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1
-
SHA512
54019dc224572bc3998339481c612ecfc101a8a46789fdbdf8cbe1f805e024a428fb95cabafd023983212f353ab9ccfb60df5d8c5ad081ccb41b19bf2bed06ee
-
SSDEEP
3072:k9lOLXp35hc4asjn0Vf3Xjmm+72uVyPXjmG2q3iR511+ZtQXGDSXvHAddkxrj:vLXpph0lzmm+6nmG2q3BZtQDXvnrj
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
185.172.128.69
Attributes
-
url_path
/advdlc.php
Signatures
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1920 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 2452 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 1112 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 1536 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 412 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 2012 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 3408 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe 1904 1720 WerFault.exe b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe"C:\Users\Admin\AppData\Local\Temp\b07790f33b42ba3afceb3669484c1f7128b2c3afd96850b9bfb4f0fb8c2c8bb1.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 10082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 7522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1720 -ip 17201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-2-0x0000000003F70000-0x0000000003F9D000-memory.dmpFilesize
180KB
-
memory/1720-3-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-1-0x0000000002440000-0x0000000002540000-memory.dmpFilesize
1024KB
-
memory/1720-4-0x0000000000400000-0x000000000236F000-memory.dmpFilesize
31.4MB
-
memory/1720-6-0x0000000002440000-0x0000000002540000-memory.dmpFilesize
1024KB