gcleaner | c4ed2e62240fac6487c1e235014d582c7beca03ee863049ca7fae0ab5627ebb6

Analysis

max time kernel
85s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc7f5dff3737dccd68b2697a934cc23c.exe
Size 376KB
Sample230522-kkanxafa98
SHA256 c4ed2e62240fac6487c1e235014d582c7beca03ee863049ca7fae0ab5627ebb6
MD5 cc7f5dff3737dccd68b2697a934cc23c
SHA1 89755aa1c75073e72c1070674bdbe09156924324
SHA512 6d9c4e7514eb7cdf018ad2936a3c00a149f8b96ec9b8dc4419164e517fcd3d51fb94c8acf4b3c37afa3ea57175080ea750d0a7bfc4ae8bc3cec772356742fbd6
SSDEEP 6144:dphULdSihYxszn4Ngrs0Blb8y6UsYWqMhVXpdT:edExcnRrs0LX6UALP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2696	4132	WerFault.exe	85
1904	4132	WerFault.exe	85
1772	4132	WerFault.exe	85
796	4132	WerFault.exe	85
4716	4132	WerFault.exe	85
216	4132	WerFault.exe	85
5072	4132	WerFault.exe	85
956	4132	WerFault.exe	85
2144	4132	WerFault.exe	85
4948	4132	WerFault.exe	85
2336	4132	WerFault.exe	85
2040	4132	WerFault.exe	85
4908	4132	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\cc7f5dff3737dccd68b2697a934cc23c.exe
"C:\Users\Admin\AppData\Local\Temp\cc7f5dff3737dccd68b2697a934cc23c.exe"
1⤵
PID:4132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 744
  2⤵
  - Program crash
  PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 760
  2⤵
  - Program crash
  PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 760
  2⤵
  - Program crash
  PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 744
  2⤵
  - Program crash
  PID:796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 904
  2⤵
  - Program crash
  PID:4716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 984
  2⤵
  - Program crash
  PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1320
  2⤵
  - Program crash
  PID:5072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1500
  2⤵
  - Program crash
  PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1576
  2⤵
  - Program crash
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1776
  2⤵
  - Program crash
  PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1616
  2⤵
  - Program crash
  PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1640
  2⤵
  - Program crash
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1636
  2⤵
  - Program crash
  PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4132 -ip 4132
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4132 -ip 4132
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4132 -ip 4132
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4132 -ip 4132
1⤵
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4132 -ip 4132
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4132 -ip 4132
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4132 -ip 4132
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4132 -ip 4132
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4132 -ip 4132
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4132 -ip 4132
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4132 -ip 4132
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4132 -ip 4132
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4132 -ip 4132
1⤵
PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4132-134-0x0000000000800000-0x0000000000842000-memory.dmp

Download

memory/4132-135-0x0000000000400000-0x00000000006A3000-memory.dmp

Download

memory/4132-142-0x0000000000400000-0x00000000006A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads