gcleaner | bf1da988e71f4e6b5aa9ad169d1637ac47ac43b548fdb1173733922d620572c5

Analysis

max time kernel
77s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2023, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd6da92bd52d003123cbc4759dec1002.exe
Size 273KB
Sample230302-nmrlzscf86
SHA256 bf1da988e71f4e6b5aa9ad169d1637ac47ac43b548fdb1173733922d620572c5
MD5 bd6da92bd52d003123cbc4759dec1002
SHA1 9dafebf9cfdc15cd54c56b767b07b0d7944d1f92
SHA512 9c7867046c173643f150a322a95f830c0a04c2bc50b72925ffb87dbf11188d54d3152d855e6741e3b107f0c92dc9e037e421d531ad2921226fe0b71042ede302
SSDEEP 6144:BqgzUOOHyHYY9CU3v/fQ1Buu48mVUKfm8XZdpqRI:BqgzyyHYY9CU3v/EBuu48iUQXAK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	bd6da92bd52d003123cbc4759dec1002.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3932	1392	WerFault.exe	85
4836	1392	WerFault.exe	85
764	1392	WerFault.exe	85
4324	1392	WerFault.exe	85
4344	1392	WerFault.exe	85
3016	1392	WerFault.exe	85
3888	1392	WerFault.exe	85

Kills process with taskkill 1 IoCs

evasion

pid	Process
1660	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1364	1392	bd6da92bd52d003123cbc4759dec1002.exe	103
PID 1392 wrote to memory of 1364	1392	bd6da92bd52d003123cbc4759dec1002.exe	103
PID 1392 wrote to memory of 1364	1392	bd6da92bd52d003123cbc4759dec1002.exe	103
PID 1364 wrote to memory of 1660	1364	cmd.exe	107
PID 1364 wrote to memory of 1660	1364	cmd.exe	107
PID 1364 wrote to memory of 1660	1364	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\bd6da92bd52d003123cbc4759dec1002.exe
"C:\Users\Admin\AppData\Local\Temp\bd6da92bd52d003123cbc4759dec1002.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 704
  2⤵
  - Program crash
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 780
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 936
  2⤵
  - Program crash
  PID:764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 768
  2⤵
  - Program crash
  PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 948
  2⤵
  - Program crash
  PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 932
  2⤵
  - Program crash
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "bd6da92bd52d003123cbc4759dec1002.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bd6da92bd52d003123cbc4759dec1002.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "bd6da92bd52d003123cbc4759dec1002.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 792
  2⤵
  - Program crash
  PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1392 -ip 1392
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1392 -ip 1392
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1392 -ip 1392
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1392 -ip 1392
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1392 -ip 1392
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1392 -ip 1392
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1392 -ip 1392
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-135-0x0000000000610000-0x0000000000650000-memory.dmp

Download

memory/1392-136-0x0000000000400000-0x0000000000588000-memory.dmp