gcleaner | 65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b

Analysis

max time kernel
34s
max time network
66s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe
Size

343KB
MD5

8deb97fea5fce1be5570f57787a8c21b
SHA1

3a1a111c133fdcd15cb1ae4ae8e626284243cbd7
SHA256

65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b
SHA512

75d2a77cecc55085cabb8769f2c0bb40531b6957061c9b3887a1bee4a2ee343dbad6cc7781829dd9de229eb281c1dabae7fe4ea831ca34b7ddb784dcc875c5e2
SSDEEP

6144:P/PL7GU5lXYN9igXC+4CqJMe7YIe3Qg2:f3GU5lXgFXC+esIbg

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1676 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1856 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1856 taskkill.exe

pid	process
1676	cmd.exe

pid	process
1856	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1856	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.execmd.exe

description	pid	process	target process
PID 1132 wrote to memory of 1676	1132	65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe	cmd.exe
PID 1132 wrote to memory of 1676	1132	65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe	cmd.exe
PID 1132 wrote to memory of 1676	1132	65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe	cmd.exe
PID 1132 wrote to memory of 1676	1132	65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe	cmd.exe
PID 1676 wrote to memory of 1856	1676	cmd.exe	taskkill.exe
PID 1676 wrote to memory of 1856	1676	cmd.exe	taskkill.exe
PID 1676 wrote to memory of 1856	1676	cmd.exe	taskkill.exe
PID 1676 wrote to memory of 1856	1676	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe
"C:\Users\Admin\AppData\Local\Temp\65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe" & exit
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "65739956328d7f12411f568fd83ea6c7ae1641fdf1c6dc450cc2c78c8242677b.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-55-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1132-56-0x0000000000400000-0x0000000002BC3000-memory.dmp

Filesize
39.8MB

Download
memory/1132-57-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1132-61-0x0000000000400000-0x0000000002BC3000-memory.dmp

Filesize
39.8MB

Download