gcleaner | 87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66

Analysis

max time kernel
41s
max time network
76s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
Size

375KB
MD5

3bad61d9d63393604c727deffc6b5160
SHA1

1cdc8045e990ee7aa86c590b3861bd0d19d997e4
SHA256

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66
SHA512

23fc23cffb79bdafb95b57d7f864489643b8dbdfc6f04605fa4e2e335e2b939645abbf718338cfe0913617a39164781e1718e20de544db607d7ba044b9f7bb54
SSDEEP

3072:s2X6pSLF3JH5z9ZE3pTqxIblSi2eIC4MYM4I82GP5Lwwxm+31+WANgth3Slo5R78:FL/ZzELadMLEzxlciSlG6u6b4e

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

688 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1012 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1012 taskkill.exe

pid	process
688	cmd.exe

pid	process
1012	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1012	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.execmd.exe

description	pid	process	target process
PID 1752 wrote to memory of 688	1752	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 1752 wrote to memory of 688	1752	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 1752 wrote to memory of 688	1752	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 1752 wrote to memory of 688	1752	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 688 wrote to memory of 1012	688	cmd.exe	taskkill.exe
PID 688 wrote to memory of 1012	688	cmd.exe	taskkill.exe
PID 688 wrote to memory of 1012	688	cmd.exe	taskkill.exe
PID 688 wrote to memory of 1012	688	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
"C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" & exit
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-55-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1752-56-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1752-57-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1752-60-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download