gcleaner | db396e0845fb4e19743f8cc0c1233f21f14a20cdf5f5c2b65b4e4d7f2a3f8791

Analysis

max time kernel
114s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4654d5533c4a669a238b47dbb0fc50a3.exe
Size

323KB
MD5

4654d5533c4a669a238b47dbb0fc50a3
SHA1

539d6e7d186315b27fd7b77957b488960cb5708b
SHA256

db396e0845fb4e19743f8cc0c1233f21f14a20cdf5f5c2b65b4e4d7f2a3f8791
SHA512

b45773ed88ec4016e5e9e67550a7258e464e78080575d92a88f3be9688db719e7f9e60a77d71949c6966725a29df02d801a8b37dec47d68b837c356e6b3ab1ec
SSDEEP

6144:AH13WD3tpBSB8coYJUTVxTOQeDp64Rotto/+qfsqpc:AV3g3t6BDoYJOBeDp6kpK

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2948	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
320	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1728	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3540	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
2228	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1944	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
1780	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
4980	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3660	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
4120	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3816	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe
3924	1940	WerFault.exe	4654d5533c4a669a238b47dbb0fc50a3.exe

C:\Users\Admin\AppData\Local\Temp\4654d5533c4a669a238b47dbb0fc50a3.exe
"C:\Users\Admin\AppData\Local\Temp\4654d5533c4a669a238b47dbb0fc50a3.exe"
1⤵
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 744
  2⤵
  - Program crash
  PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 736
  2⤵
  - Program crash
  PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 736
  2⤵
  - Program crash
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 800
  2⤵
  - Program crash
  PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 904
  2⤵
  - Program crash
  PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 976
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1016
  2⤵
  - Program crash
  PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1496
  2⤵
  - Program crash
  PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1516
  2⤵
  - Program crash
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1564
  2⤵
  - Program crash
  PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1560
  2⤵
  - Program crash
  PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 972
  2⤵
  - Program crash
  PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1940 -ip 1940
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1940 -ip 1940
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1940 -ip 1940
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1940 -ip 1940
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1940 -ip 1940
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1940 -ip 1940
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1940 -ip 1940
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1940 -ip 1940
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1940 -ip 1940
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1940 -ip 1940
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1940 -ip 1940
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1940 -ip 1940
1⤵
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-134-0x0000000002560000-0x00000000025A0000-memory.dmp

Filesize
256KB

Download
memory/1940-140-0x0000000000400000-0x0000000000805000-memory.dmp

Filesize
4.0MB

Download