Analysis
- max time kernel
143s - max time network
150s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
16/01/2023, 16:07
General
- Target file.exe
- Size 1.7MB
- Sample230116-tkmsxade4z
- SHA256 ace119e70679b965df9fa7516294d3adbb6d137a1de65756465bfdf1eeff7581
Malware Config
Extracted
-
gcleaner
-
45.139.105.171
-
85.31.46.167
-
107.182.129.235
-
171.22.30.106
Signatures
- GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 9 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AR3L6.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-AR3L6.tmp\file.tmp" /SL5="$70124,1575301,54272,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MeetsoftFR\FinalRecovery\finalrecovery.exe"C:\Program Files (x86)\MeetsoftFR\FinalRecovery\finalrecovery.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\sQot76aMN.exe4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
finalrecovery.exe
file.tmp
file.tmp
sQot76aMN.exe
finalrecovery.exe
file.tmp
_iscrypt.dll
_shfoldr.dll
_shfoldr.dll
sQot76aMN.exe
memory/1484-71-0x0000000000400000-0x00000000013E6000-memory.dmp
memory/1484-72-0x0000000000400000-0x00000000013E6000-memory.dmp
memory/1484-73-0x0000000000400000-0x00000000013E6000-memory.dmp
memory/1484-78-0x0000000000400000-0x00000000013E6000-memory.dmp
memory/1992-70-0x0000000003660000-0x0000000004646000-memory.dmp
memory/1992-77-0x0000000003660000-0x0000000004646000-memory.dmp
memory/2016-69-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2016-54-0x00000000757A1000-0x00000000757A3000-memory.dmp
memory/2016-55-0x0000000000400000-0x0000000000414000-memory.dmp