gcleaner | db396e0845fb4e19743f8cc0c1233f21f14a20cdf5f5c2b65b4e4d7f2a3f8791

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4654d5533c4a669a238b47dbb0fc50a3.exe
Size

323KB
MD5

4654d5533c4a669a238b47dbb0fc50a3
SHA1

539d6e7d186315b27fd7b77957b488960cb5708b
SHA256

db396e0845fb4e19743f8cc0c1233f21f14a20cdf5f5c2b65b4e4d7f2a3f8791
SHA512

b45773ed88ec4016e5e9e67550a7258e464e78080575d92a88f3be9688db719e7f9e60a77d71949c6966725a29df02d801a8b37dec47d68b837c356e6b3ab1ec
SSDEEP

6144:AH13WD3tpBSB8coYJUTVxTOQeDp64Rotto/+qfsqpc:AV3g3t6BDoYJOBeDp6kpK

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1892	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
4840	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1104	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
4596	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3088	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
2956	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
4892	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1920	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1032	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
5092	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1356	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3956	3944	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe

C:\Users\Admin\AppData\Local\Temp\4654d5533c4a669a238b47dbb0fc50a3.exe
"C:\Users\Admin\AppData\Local\Temp\4654d5533c4a669a238b47dbb0fc50a3.exe"
1⤵
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 748
  2⤵
  - Program crash
  PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 776
  2⤵
  - Program crash
  PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 776
  2⤵
  - Program crash
  PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 768
  2⤵
  - Program crash
  PID:4596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 904
  2⤵
  - Program crash
  PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 980
  2⤵
  - Program crash
  PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1008
  2⤵
  - Program crash
  PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1496
  2⤵
  - Program crash
  PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1552
  2⤵
  - Program crash
  PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1768
  2⤵
  - Program crash
  PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1764
  2⤵
  - Program crash
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1768
  2⤵
  - Program crash
  PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3944 -ip 3944
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3944 -ip 3944
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3944 -ip 3944
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3944 -ip 3944
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3944 -ip 3944
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3944 -ip 3944
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3944 -ip 3944
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3944 -ip 3944
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3944 -ip 3944
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3944 -ip 3944
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3944 -ip 3944
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3944 -ip 3944
1⤵
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-134-0x0000000002570000-0x00000000025B0000-memory.dmp

Filesize
256KB

Download
memory/3944-140-0x0000000000400000-0x0000000000805000-memory.dmp

Filesize
4.0MB

Download