gcleaner | 68bc628a7d81fe62482cc6e60ebade1d504dfbf631539b0baa46db764d109e8b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2023, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d7c79f58ed99de60755774f6b57226c.exe
Size 316KB
Sample230619-nyfc4adf46
SHA256 68bc628a7d81fe62482cc6e60ebade1d504dfbf631539b0baa46db764d109e8b
MD5 8d7c79f58ed99de60755774f6b57226c
SHA1 e1aa956f6922e18eb560bad3d5bdfb2d0945419c
SHA512 dde3a12717cb49148cd5910c001262283abb1bea7bd9903cdf7ef3b5a4afd2ad720a6f8d329a86cf41f033cd07708d7fa6191caf4fea3b4f86add55ceb76baca
SSDEEP 6144:NTxv86kh3sIzzONOlpTZ8O0z1NjEPH01GVpgG/:Nh86k6IuMbTZl0zXRs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4972	1908	WerFault.exe	84
428	1908	WerFault.exe	84
3396	1908	WerFault.exe	84
2688	1908	WerFault.exe	84
32	1908	WerFault.exe	84
1048	1908	WerFault.exe	84
976	1908	WerFault.exe	84
3736	1908	WerFault.exe	84
1504	1908	WerFault.exe	84
1188	1908	WerFault.exe	84
2304	1908	WerFault.exe	84
1820	1908	WerFault.exe	84
3724	1908	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\8d7c79f58ed99de60755774f6b57226c.exe
"C:\Users\Admin\AppData\Local\Temp\8d7c79f58ed99de60755774f6b57226c.exe"
1⤵
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 740
  2⤵
  - Program crash
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 760
  2⤵
  - Program crash
  PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 760
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 776
  2⤵
  - Program crash
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 904
  2⤵
  - Program crash
  PID:32
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 908
  2⤵
  - Program crash
  PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1016
  2⤵
  - Program crash
  PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1520
  2⤵
  - Program crash
  PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1572
  2⤵
  - Program crash
  PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1764
  2⤵
  - Program crash
  PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1588
  2⤵
  - Program crash
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1628
  2⤵
  - Program crash
  PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1760
  2⤵
  - Program crash
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1908 -ip 1908
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1908 -ip 1908
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1908 -ip 1908
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 1908
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1908 -ip 1908
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1908 -ip 1908
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 1908
1⤵
PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1908 -ip 1908
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1908 -ip 1908
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 1908
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1908 -ip 1908
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1908 -ip 1908
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1908 -ip 1908
1⤵
PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-133-0x0000000002540000-0x0000000002567000-memory.dmp

Download

memory/1908-134-0x0000000002570000-0x00000000025B2000-memory.dmp

Download

memory/1908-140-0x0000000000400000-0x0000000000934000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads