gcleaner | d9b345020df8d580d21150d66da61ce6c4f3bfb1f3fc029a4b40fe9615006757

Analysis

max time kernel
91s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6820a3ee6adc057dcb2b9b373d60b71b.exe
Size

404KB
MD5

6820a3ee6adc057dcb2b9b373d60b71b
SHA1

f9e9cc076b5567a03971a7ab54c2d1719a76751e
SHA256

d9b345020df8d580d21150d66da61ce6c4f3bfb1f3fc029a4b40fe9615006757
SHA512

c54c01bc4d03685c0d77907818f982aaf2442db3c6a9cf7202d5b37e7c937f4c61a728e3e5ab17baabf38377872915e930eef8eefd9e7c4ebdc902fc6c83fe3b
SSDEEP

3072:5CWx2NjVNpkN+GWP9R4OqH1D7TabyrFEAqEMXggbuT1xC+jZY8Q6aIZU1SPlgLMF:IQ2NJNppafamBEAqeTDu8Q6BZ8nOm

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2792	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
1524	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
4204	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
2084	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
3696	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
4868	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
2156	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
2768	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
3348	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
3972	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
3512	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe
1252	4104	WerFault.exe	6820a3ee6adc057dcb2b9b373d60b71b.exe

C:\Users\Admin\AppData\Local\Temp\6820a3ee6adc057dcb2b9b373d60b71b.exe
"C:\Users\Admin\AppData\Local\Temp\6820a3ee6adc057dcb2b9b373d60b71b.exe"
1⤵
PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 740
  2⤵
  - Program crash
  PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 760
  2⤵
  - Program crash
  PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 764
  2⤵
  - Program crash
  PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 832
  2⤵
  - Program crash
  PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 904
  2⤵
  - Program crash
  PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 908
  2⤵
  - Program crash
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1124
  2⤵
  - Program crash
  PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1512
  2⤵
  - Program crash
  PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1556
  2⤵
  - Program crash
  PID:3348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1596
  2⤵
  - Program crash
  PID:3972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1628
  2⤵
  - Program crash
  PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 972
  2⤵
  - Program crash
  PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4104 -ip 4104
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4104 -ip 4104
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4104 -ip 4104
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 4104
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4104 -ip 4104
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 4104
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4104 -ip 4104
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4104 -ip 4104
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4104 -ip 4104
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 4104
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4104 -ip 4104
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4104 -ip 4104
1⤵
PID:488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-135-0x0000000004010000-0x0000000004050000-memory.dmp

Filesize
256KB

Download
memory/4104-141-0x0000000000400000-0x00000000022CE000-memory.dmp

Filesize
30.8MB

Download