Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
14/07/2023, 14:17
General
-
Target
file.exe
-
Size
1.7MB
-
MD5
29521f9edea014c78a2e0d9761c804da
-
SHA1
2dde8b0eca944502a4dcc0c5ee69dee7dd933ca7
-
SHA256
1b4582f1def49a5846ac0740147c1a614b0e3bcaf39f537548c723a9c0f8cf76
-
SHA512
129e34333a6029199c25d116d71393a9ed09491ced8db5c588f5c23dea4195495a56b1c5932eb8353ea1b514bf25cc5bcb6427b0c1ebd01fb6cf4ac39864e965
-
SSDEEP
24576:1fOyJaQTpshGS7Q2HCZsII7m2/8GZy+Hbuy/DHOo32gTl4Xx6JwFGPsQwanNUWC5:1GyaQShGSC3b2FZ3R/Lh2vqwFHav8
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 31 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H05O8.tmp\is-UTUJ8.tmp"C:\Users\Admin\AppData\Local\Temp\is-H05O8.tmp\is-UTUJ8.tmp" /SL4 $A014C "C:\Users\Admin\AppData\Local\Temp\file.exe" 1468899 691202⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 143⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 144⤵
-
-
-
C:\Program Files (x86)\RewSpacer714\RewSpacer714.exe"C:\Program Files (x86)\RewSpacer714\RewSpacer714.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\d7NBZeeydP.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "RewSpacer714.exe" /f & erase "C:\Program Files (x86)\RewSpacer714\RewSpacer714.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "RewSpacer714.exe" /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5c0d5374f2bc16b2bb601e0ae7653c806
SHA1073cb53bfaf7abb3ff09fc83cd8a3b716ac8e027
SHA256fc5615a81fa69713d7c1526b3f81a5dd523d21175558193eef757c82eb80f5f2
SHA512426d14b03bc0fbc2196922a5186eb23b84271ab16419a4a22cf5cae1d62ab6aad923a5e5a7ef82842e31e05433a4b465b6f7cf6a7a97cfb85d499c1456ead0db
-
Filesize
2.6MB
MD5c0d5374f2bc16b2bb601e0ae7653c806
SHA1073cb53bfaf7abb3ff09fc83cd8a3b716ac8e027
SHA256fc5615a81fa69713d7c1526b3f81a5dd523d21175558193eef757c82eb80f5f2
SHA512426d14b03bc0fbc2196922a5186eb23b84271ab16419a4a22cf5cae1d62ab6aad923a5e5a7ef82842e31e05433a4b465b6f7cf6a7a97cfb85d499c1456ead0db
-
Filesize
4KB
MD5ce494d2d223aed950fea67f657d3fa3e
SHA197a19c02487c41e3a079cd6764afffeb5e838b26
SHA256c8fa111c5b9537e3b6cab9ba763e164e27fa469f2232b82a54b206a7d892b9e9
SHA512687bf3bd7de28dc45ea622672dc59d7e45d9ce83530a7db6462447ea247a9bde061738c454e09b48531aab9cce802c8491aa730e4da65e63daf31c65ffc39fe1
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
664KB
MD597dec87a9da7f4160ead62a15c2cf033
SHA1ee5228d2958b90ab3ecfa1a363de3ca32c547a3b
SHA25604848c87d6b705e7fee4c3bb74420bd5323ea4a56414be34bab023d0dd1986ef
SHA512660352e47c1db439a262498a4b2cf0f20e0f6051700ca3d3934e158a613cebdbd057a7868804de1ad3e063af0d31288efed57302cfb40d5f16ff552957f523ea
-
Filesize
664KB
MD597dec87a9da7f4160ead62a15c2cf033
SHA1ee5228d2958b90ab3ecfa1a363de3ca32c547a3b
SHA25604848c87d6b705e7fee4c3bb74420bd5323ea4a56414be34bab023d0dd1986ef
SHA512660352e47c1db439a262498a4b2cf0f20e0f6051700ca3d3934e158a613cebdbd057a7868804de1ad3e063af0d31288efed57302cfb40d5f16ff552957f523ea
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
Filesize
2.6MB
MD5c0d5374f2bc16b2bb601e0ae7653c806
SHA1073cb53bfaf7abb3ff09fc83cd8a3b716ac8e027
SHA256fc5615a81fa69713d7c1526b3f81a5dd523d21175558193eef757c82eb80f5f2
SHA512426d14b03bc0fbc2196922a5186eb23b84271ab16419a4a22cf5cae1d62ab6aad923a5e5a7ef82842e31e05433a4b465b6f7cf6a7a97cfb85d499c1456ead0db
-
Filesize
664KB
MD597dec87a9da7f4160ead62a15c2cf033
SHA1ee5228d2958b90ab3ecfa1a363de3ca32c547a3b
SHA25604848c87d6b705e7fee4c3bb74420bd5323ea4a56414be34bab023d0dd1986ef
SHA512660352e47c1db439a262498a4b2cf0f20e0f6051700ca3d3934e158a613cebdbd057a7868804de1ad3e063af0d31288efed57302cfb40d5f16ff552957f523ea
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
108KB
-
Filesize
16.6MB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
16.6MB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
724KB
-
Filesize
4KB