Behavioral task
behavioral1
Sample
700-74-0x0000000000400000-0x0000000001534000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
700-74-0x0000000000400000-0x0000000001534000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
700-74-0x0000000000400000-0x0000000001534000-memory.dmp
-
Size
17.2MB
-
MD5
d9ee724df7a71b75d4a73445af680d37
-
SHA1
2778f2127473434adb35656dc8d321c3c1fb126a
-
SHA256
7f84d80b8fe38f24a235c38fbf353c1e813ed9adee125ad2714ac6dfa9e9e67c
-
SHA512
5b81a46521cad5ad2ed120e3f8b06926f86ad6509a4cf6f7ff633754b2f3ad7d2f758668bff5631d2007ce61c9685c4aa444359155c703a3a893d72a4f123a20
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0hyRLOSfmiXG:S3JNBiYSOt
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
700-74-0x0000000000400000-0x0000000001534000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ