Behavioral task
behavioral1
Sample
1408-74-0x0000000000400000-0x0000000001534000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1408-74-0x0000000000400000-0x0000000001534000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1408-74-0x0000000000400000-0x0000000001534000-memory.dmp
-
Size
17.2MB
-
MD5
251f6b024a3ba20e92dc7efafb8e8045
-
SHA1
d26ee4ea002a3e92bfbfc0c72509b379fd84b7fa
-
SHA256
e1c0f036ae3fcb208b1d409f6dd25893db61d19e44535ba2515c42a8739afec0
-
SHA512
35a28eec890c0dac4a394689e516278f7df5223615eb2c0dd0ead305e071b5d22205179c3d46993f0c08e72ee1b85fd7d0c2ce28c03f4d16af6a64d52b9bb791
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0ByxLOSfmiCG:S3JNB24SOC
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
1408-74-0x0000000000400000-0x0000000001534000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ