gcleaner | 82f925cdbc4e80afe800f7e29f86866a9d975b5b3316927618aa66c61bf63e89

Analysis

max time kernel
123s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2023, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60eb185181f8b9a4e1d5d5dca23314a8c1cc7c20b9fb885b897709cab8b896d4.exe
Size 355KB
Sample230701-b2q8jsfc57
SHA256 60eb185181f8b9a4e1d5d5dca23314a8c1cc7c20b9fb885b897709cab8b896d4
MD5 b4c89f519625821ad10099d181949be4
SHA1 a296d2869d4a01448d30610ea4894f6af980975b
SHA512 12d1d47554ab030ceeb69d6efc4c4ec0ccbbe2aef20a6a215135937699d5233bd07608a1362edcd4455fc76ef12fbe6cbc0a031f0a6cd4c29434e128100abb62
SSDEEP 6144:2TQHKtSp2oH0c65+qvTh91d/+z4B7SBtha/qmf0:/qMp2oU1+gf1S42aRf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

pid	pid_target	Process	procid_target
3580	2484	WerFault.exe	82
3864	2484	WerFault.exe	82
3528	2484	WerFault.exe	82
1552	2484	WerFault.exe	82
4056	2484	WerFault.exe	82
2988	2484	WerFault.exe	82
324	2484	WerFault.exe	82
1680	2484	WerFault.exe	82
2004	2484	WerFault.exe	82
976	2484	WerFault.exe	82
4920	2484	WerFault.exe	82
2268	2484	WerFault.exe	82
3212	2484	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\60eb185181f8b9a4e1d5d5dca23314a8c1cc7c20b9fb885b897709cab8b896d4.exe
"C:\Users\Admin\AppData\Local\Temp\60eb185181f8b9a4e1d5d5dca23314a8c1cc7c20b9fb885b897709cab8b896d4.exe"
1⤵
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 732
  2⤵
  - Program crash
  PID:3580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 760
  2⤵
  - Program crash
  PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 760
  2⤵
  - Program crash
  PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 812
  2⤵
  - Program crash
  PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 904
  2⤵
  - Program crash
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 984
  2⤵
  - Program crash
  PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 904
  2⤵
  - Program crash
  PID:324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1500
  2⤵
  - Program crash
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1580
  2⤵
  - Program crash
  PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1816
  2⤵
  - Program crash
  PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1620
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1588
  2⤵
  - Program crash
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1668
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2484 -ip 2484
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2484 -ip 2484
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2484 -ip 2484
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2484 -ip 2484
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2484 -ip 2484
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2484 -ip 2484
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2484 -ip 2484
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2484 -ip 2484
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2484 -ip 2484
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2484 -ip 2484
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2484 -ip 2484
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2484 -ip 2484
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2484 -ip 2484
1⤵
PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-134-0x0000000000530000-0x0000000000572000-memory.dmp

Download

memory/2484-140-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads