gcleaner | 1cd320a873c015b23f6a3e60e6d635e605fb9d9eca5b5f356fc5900a56d25e64

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2023, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb0074e7f3e4085fa3425a95ac050000.exe
Size 307KB
Sample230602-lbxmrabb6x
SHA256 1cd320a873c015b23f6a3e60e6d635e605fb9d9eca5b5f356fc5900a56d25e64
MD5 bb0074e7f3e4085fa3425a95ac050000
SHA1 a816f26f1f7030d5c42f4cd724ddacfc398be2cb
SHA512 e9bcf76e932e01f2bb455a9a7db31574103aee09b2d0473262f17047c821356ca4426a655449e22af72770a8a7f88773b50fe6e65f873908941ef37a0aa524f2
SSDEEP 3072:0XjlXtY3vdSwiGLdteDp1AJBM0ibkg/eNAQt4r9g31xLwB8I53dSymq5T6eU:wED3Q1EmwgqtI9grwBrJ8EZU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 14 IoCs

pid	pid_target	Process	procid_target
688	3976	WerFault.exe	83
4304	3976	WerFault.exe	83
2740	3976	WerFault.exe	83
5080	3976	WerFault.exe	83
2444	3976	WerFault.exe	83
1108	3976	WerFault.exe	83
4152	3976	WerFault.exe	83
1216	3976	WerFault.exe	83
4240	3976	WerFault.exe	83
4924	3976	WerFault.exe	83
2936	3976	WerFault.exe	83
2760	3976	WerFault.exe	83
1416	3976	WerFault.exe	83
2032	3976	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\bb0074e7f3e4085fa3425a95ac050000.exe
"C:\Users\Admin\AppData\Local\Temp\bb0074e7f3e4085fa3425a95ac050000.exe"
1⤵
PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 740
  2⤵
  - Program crash
  PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 748
  2⤵
  - Program crash
  PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 792
  2⤵
  - Program crash
  PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 800
  2⤵
  - Program crash
  PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 920
  2⤵
  - Program crash
  PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 980
  2⤵
  - Program crash
  PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1016
  2⤵
  - Program crash
  PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1504
  2⤵
  - Program crash
  PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1568
  2⤵
  - Program crash
  PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1764
  2⤵
  - Program crash
  PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1812
  2⤵
  - Program crash
  PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1796
  2⤵
  - Program crash
  PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1880
  2⤵
  - Program crash
  PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1856
  2⤵
  - Program crash
  PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3976 -ip 3976
1⤵
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3976 -ip 3976
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3976 -ip 3976
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3976 -ip 3976
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3976 -ip 3976
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3976 -ip 3976
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3976 -ip 3976
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3976 -ip 3976
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3976 -ip 3976
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3976 -ip 3976
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3976 -ip 3976
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3976 -ip 3976
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3976 -ip 3976
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3976 -ip 3976
1⤵
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-134-0x0000000004170000-0x00000000041B2000-memory.dmp

Download

memory/3976-135-0x0000000000400000-0x0000000002578000-memory.dmp

Download

memory/3976-142-0x0000000000400000-0x0000000002578000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads