gcleaner | bf9f1faeb5ffafd35851df4a42f7a486ad0b2eb3f77ccc943c4cd21d1a75e3c0

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2023, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11b8d2f1c1da99d2eec370ecf4bca6fc.exe
Size 363KB
Sample230528-h6nrjsfa31
SHA256 bf9f1faeb5ffafd35851df4a42f7a486ad0b2eb3f77ccc943c4cd21d1a75e3c0
MD5 11b8d2f1c1da99d2eec370ecf4bca6fc
SHA1 de11984271c74e9169237fa9d4391b17e871b23f
SHA512 ad7e05230478a363db6f07915f7675c396c85e3c7f843c1d0c4cac762acd45509f40836f9119a19d38693ff4c416c0a157afe996347c666245c6de06cc89ea5f
SSDEEP 6144:bls/DTNiyXaYJczQRmImjkj/Tjrtim4EeOoP0/:pi/QIaYJIQcX6/JimP9o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2232	4532	WerFault.exe	83
4424	4532	WerFault.exe	83
2528	4532	WerFault.exe	83
4584	4532	WerFault.exe	83
228	4532	WerFault.exe	83
4780	4532	WerFault.exe	83
3584	4532	WerFault.exe	83
384	4532	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\11b8d2f1c1da99d2eec370ecf4bca6fc.exe
"C:\Users\Admin\AppData\Local\Temp\11b8d2f1c1da99d2eec370ecf4bca6fc.exe"
1⤵
PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 748
  2⤵
  - Program crash
  PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 748
  2⤵
  - Program crash
  PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 748
  2⤵
  - Program crash
  PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 812
  2⤵
  - Program crash
  PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 904
  2⤵
  - Program crash
  PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 980
  2⤵
  - Program crash
  PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 1020
  2⤵
  - Program crash
  PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 968
  2⤵
  - Program crash
  PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4532 -ip 4532
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4532 -ip 4532
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4532 -ip 4532
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4532 -ip 4532
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4532 -ip 4532
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4532 -ip 4532
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4532 -ip 4532
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4532 -ip 4532
1⤵
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4532-134-0x00000000023E0000-0x0000000002422000-memory.dmp

Download

memory/4532-135-0x0000000000400000-0x00000000006A1000-memory.dmp

Download

memory/4532-139-0x0000000000400000-0x00000000006A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads