Behavioral task
behavioral1
Sample
1512-73-0x0000000000400000-0x00000000013DB000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1512-73-0x0000000000400000-0x00000000013DB000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1512-73-0x0000000000400000-0x00000000013DB000-memory.dmp
-
Size
15.9MB
-
MD5
9e02e9619be7e15ac42f9f9079a57160
-
SHA1
ebab8d767f57898acbe6c61eb8250e5be73a330f
-
SHA256
14c8b2eebba87a0669ee70ac71d3ecba7a9229d7cfb3b6001979b8b833a62c06
-
SHA512
89a937b66f5610105e86f0085cc90079e39e01bf1634627a76a3f2e653e3d6637e6474eb076428e9fc188e9cc888e4218e8e9fa5d89825d275369bd03a5dda9c
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0ayqLOSfmiKG:S3JNBvxSO6
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
1512-73-0x0000000000400000-0x00000000013DB000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ