gcleaner | 51185073ceba91e714aa20b898882ce21a0d1240d706c2fce02438532efeb0dd

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08aa279530fc15a5154dae1c200a622b.exe
Size

271KB
MD5

08aa279530fc15a5154dae1c200a622b
SHA1

e0ec3c44a357437b0057d491944204c2b252bfbd
SHA256

51185073ceba91e714aa20b898882ce21a0d1240d706c2fce02438532efeb0dd
SHA512

72882e46b0c6a4526a1410b9f2c42cc4fb1fc405e8bb92d14736a0aa2a6aca35dda09dd30b3fc033c1570fdb04d81f7fe372bc92ca034a2919a0a107def13c41
SSDEEP

6144:O74bmuHkMqntJqpmt1WTcwh9h9QUiRLxTF:O74fEBXqpmt1Whh9TQUWB

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3328	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
3636	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
924	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
216	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
1560	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
3884	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
1292	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
448	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
2632	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
5040	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
3768	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
4748	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe
3292	1988	WerFault.exe	08aa279530fc15a5154dae1c200a622b.exe

C:\Users\Admin\AppData\Local\Temp\08aa279530fc15a5154dae1c200a622b.exe
"C:\Users\Admin\AppData\Local\Temp\08aa279530fc15a5154dae1c200a622b.exe"
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 740
2⤵
- Program crash
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 784
2⤵
- Program crash
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 784
2⤵
- Program crash
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 832
2⤵
- Program crash
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 904
2⤵
- Program crash
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 980
2⤵
- Program crash
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1004
2⤵
- Program crash
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1524
2⤵
- Program crash
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1548
2⤵
- Program crash
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1764
2⤵
- Program crash
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1796
2⤵
- Program crash
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1840
2⤵
- Program crash
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1848
2⤵
- Program crash
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1988 -ip 1988
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1988 -ip 1988
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1988 -ip 1988
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1988 -ip 1988
1⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1988 -ip 1988
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1988 -ip 1988
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1988 -ip 1988
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1988 -ip 1988
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1988 -ip 1988
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1988 -ip 1988
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1988 -ip 1988
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1988 -ip 1988
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1988 -ip 1988
1⤵
PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-134-0x0000000002200000-0x0000000002240000-memory.dmp

Filesize
256KB

Download
memory/1988-135-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1988-142-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download