gcleaner | 87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66

General

Target

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
Size

375KB
MD5

3bad61d9d63393604c727deffc6b5160
SHA1

1cdc8045e990ee7aa86c590b3861bd0d19d997e4
SHA256

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66
SHA512

23fc23cffb79bdafb95b57d7f864489643b8dbdfc6f04605fa4e2e335e2b939645abbf718338cfe0913617a39164781e1718e20de544db607d7ba044b9f7bb54
SSDEEP

3072:s2X6pSLF3JH5z9ZE3pTqxIblSi2eIC4MYM4I82GP5Lwwxm+31+WANgth3Slo5R78:FL/ZzELadMLEzxlciSlG6u6b4e

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2780	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
1012	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
4884	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
228	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
4444	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
2280	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
4184	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
4144	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
3692	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
2632	4840	WerFault.exe	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3052 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3052 taskkill.exe

pid	process
3052	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3052	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.execmd.exe

description	pid	process	target process
PID 4840 wrote to memory of 4604	4840	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 4840 wrote to memory of 4604	4840	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 4840 wrote to memory of 4604	4840	87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe	cmd.exe
PID 4604 wrote to memory of 3052	4604	cmd.exe	taskkill.exe
PID 4604 wrote to memory of 3052	4604	cmd.exe	taskkill.exe
PID 4604 wrote to memory of 3052	4604	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe
"C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 456
2⤵
- Program crash
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 764
2⤵
- Program crash
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 764
2⤵
- Program crash
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 764
2⤵
- Program crash
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 836
2⤵
- Program crash
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 928
2⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 928
2⤵
- Program crash
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1148
2⤵
- Program crash
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1356
2⤵
- Program crash
PID:3692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "87b5b85d4012bed6eed16f45775e00f32063652e2509a809ff00c6087c3c7f66.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 492
2⤵
- Program crash
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4840 -ip 4840
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4840 -ip 4840
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4840 -ip 4840
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4840 -ip 4840
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4840 -ip 4840
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4840 -ip 4840
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4840 -ip 4840
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4840 -ip 4840
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4840 -ip 4840
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4840 -ip 4840
1⤵
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4840-134-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/4840-135-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4840-136-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/4840-140-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads