gcleaner | 8a2ed465f876e200314451371c46e38ddb7dae622efe7f60bb7d58d9291651d5

Analysis

max time kernel
78s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2023, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bfe0a34bb6494a9b1e866efe97ccd11b.exe
Size 273KB
Sample230302-nmrlzscf87
SHA256 8a2ed465f876e200314451371c46e38ddb7dae622efe7f60bb7d58d9291651d5
MD5 bfe0a34bb6494a9b1e866efe97ccd11b
SHA1 2222524e5bf603c3166ed445ae5f94f2ebe1fc6e
SHA512 9520cace14670c5aff3fcad7476c231d04b4a8b152f0af12cabbcc1a4947ca9007a2a65e3cf010e9a6dfd0f2388cc58def7d8e28338c3f516c0733613e28111c
SSDEEP 6144:5qgB6W89GHqzCzKDJUF3sIcqZi5WZbvEeTqa48Hd/:5qgB6bGHqzCGUF3niUHz485
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	bfe0a34bb6494a9b1e866efe97ccd11b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3796	2840	WerFault.exe	85
1584	2840	WerFault.exe	85
2104	2840	WerFault.exe	85
4064	2840	WerFault.exe	85
4500	2840	WerFault.exe	85
4648	2840	WerFault.exe	85
4384	2840	WerFault.exe	85
1812	2840	WerFault.exe	85
3808	2840	WerFault.exe	85
1712	2840	WerFault.exe	85

Kills process with taskkill 1 IoCs

evasion

pid	Process
4788	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3408	2840	bfe0a34bb6494a9b1e866efe97ccd11b.exe	107
PID 2840 wrote to memory of 3408	2840	bfe0a34bb6494a9b1e866efe97ccd11b.exe	107
PID 2840 wrote to memory of 3408	2840	bfe0a34bb6494a9b1e866efe97ccd11b.exe	107
PID 3408 wrote to memory of 4788	3408	cmd.exe	110
PID 3408 wrote to memory of 4788	3408	cmd.exe	110
PID 3408 wrote to memory of 4788	3408	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\bfe0a34bb6494a9b1e866efe97ccd11b.exe
"C:\Users\Admin\AppData\Local\Temp\bfe0a34bb6494a9b1e866efe97ccd11b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 456
  2⤵
  - Program crash
  PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 764
  2⤵
  - Program crash
  PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 784
  2⤵
  - Program crash
  PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 776
  2⤵
  - Program crash
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 856
  2⤵
  - Program crash
  PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 984
  2⤵
  - Program crash
  PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1004
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1048
  2⤵
  - Program crash
  PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1364
  2⤵
  - Program crash
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "bfe0a34bb6494a9b1e866efe97ccd11b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bfe0a34bb6494a9b1e866efe97ccd11b.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "bfe0a34bb6494a9b1e866efe97ccd11b.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 468
  2⤵
  - Program crash
  PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2840 -ip 2840
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2840 -ip 2840
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2840 -ip 2840
1⤵
PID:324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2840 -ip 2840
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2840 -ip 2840
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2840 -ip 2840
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2840 -ip 2840
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2840 -ip 2840
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2840 -ip 2840
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2840 -ip 2840
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-134-0x00000000021C0000-0x0000000002200000-memory.dmp

Download

memory/2840-136-0x0000000000400000-0x0000000000588000-memory.dmp