gcleaner | a9a3e6176cc8b8638f2bdadebeea743e50b758468c019530bb4d72cd70a66009

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2023, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d98c9515d543f336051bb51168cdc068.exe
Size 353KB
Sample230619-ltcqasda95
SHA256 a9a3e6176cc8b8638f2bdadebeea743e50b758468c019530bb4d72cd70a66009
MD5 d98c9515d543f336051bb51168cdc068
SHA1 9b5809b45e503055bc247d1677ceb72c6c5dce08
SHA512 5f6c6a24803db85a4da31481ede91df09b42bd30c1e6f79b2dc788a62b75206385303404fcfc8171cdb0abd0643e422aee28e0bbf3016f28e25636b0e1995a35
SSDEEP 6144:HaHTO4EkxPGpnt3l8KnLZUBKb9Q4O5xMziLTo8YvP8t6skS:CsUGpTnNUBEOvMzifk8t2S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

pid	pid_target	Process	procid_target
640	4508	WerFault.exe	84
796	4508	WerFault.exe	84
2220	4508	WerFault.exe	84
816	4508	WerFault.exe	84
1852	4508	WerFault.exe	84
116	4508	WerFault.exe	84
3496	4508	WerFault.exe	84
2540	4508	WerFault.exe	84
2516	4508	WerFault.exe	84
3400	4508	WerFault.exe	84
5032	4508	WerFault.exe	84
1528	4508	WerFault.exe	84
552	4508	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\d98c9515d543f336051bb51168cdc068.exe
"C:\Users\Admin\AppData\Local\Temp\d98c9515d543f336051bb51168cdc068.exe"
1⤵
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 752
  2⤵
  - Program crash
  PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 760
  2⤵
  - Program crash
  PID:796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 780
  2⤵
  - Program crash
  PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 816
  2⤵
  - Program crash
  PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 904
  2⤵
  - Program crash
  PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1000
  2⤵
  - Program crash
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 988
  2⤵
  - Program crash
  PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1500
  2⤵
  - Program crash
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1592
  2⤵
  - Program crash
  PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1776
  2⤵
  - Program crash
  PID:3400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1612
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1596
  2⤵
  - Program crash
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 972
  2⤵
  - Program crash
  PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4508 -ip 4508
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4508 -ip 4508
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4508 -ip 4508
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4508 -ip 4508
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4508 -ip 4508
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4508 -ip 4508
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4508 -ip 4508
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4508 -ip 4508
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4508 -ip 4508
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4508 -ip 4508
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 4508
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4508 -ip 4508
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4508 -ip 4508
1⤵
PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4508-133-0x0000000002690000-0x00000000026B7000-memory.dmp

Download

memory/4508-134-0x00000000026C0000-0x0000000002702000-memory.dmp

Download

memory/4508-140-0x0000000000400000-0x000000000093D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads