gcleaner | 69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2023, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c_JC.exe
Size 403KB
Sample230805-mng89sda91
SHA256 69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c
MD5 f96281b847a320f20f61912a44891fab
SHA1 d825d60b3a40d2161c6b578c2aa458374833b89f
SHA512 25aafd10bbfd6fbbdc805b70770687a7622b80aaa4c8d575b2dd1ba65cf7360ec6140b9906713a1e267985264252fa7f581291764659db330bf67c83080d3033
SSDEEP 6144:IFF/107QE8s1tcYW6vJfnKbV/m/Q+4dEXseY:ItsQE8Sd9FnKbZm/Q+4dV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file

Program crash 13 IoCs

pid	pid_target	Process	procid_target
3560	3852	WerFault.exe	82
1800	3852	WerFault.exe	82
1288	3852	WerFault.exe	82
3688	3852	WerFault.exe	82
3472	3852	WerFault.exe	82
2760	3852	WerFault.exe	82
4688	3852	WerFault.exe	82
3088	3852	WerFault.exe	82
2812	3852	WerFault.exe	82
4824	3852	WerFault.exe	82
3036	3852	WerFault.exe	82
4908	3852	WerFault.exe	82
2484	3852	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c_JC.exe"
1⤵
PID:3852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 744
  2⤵
  - Program crash
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 780
  2⤵
  - Program crash
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 820
  2⤵
  - Program crash
  PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 868
  2⤵
  - Program crash
  PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 768
  2⤵
  - Program crash
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 952
  2⤵
  - Program crash
  PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1320
  2⤵
  - Program crash
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1480
  2⤵
  - Program crash
  PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1540
  2⤵
  - Program crash
  PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1752
  2⤵
  - Program crash
  PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1556
  2⤵
  - Program crash
  PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1544
  2⤵
  - Program crash
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1596
  2⤵
  - Program crash
  PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3852 -ip 3852
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3852 -ip 3852
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3852 -ip 3852
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3852 -ip 3852
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3852 -ip 3852
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3852 -ip 3852
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3852 -ip 3852
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3852 -ip 3852
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3852 -ip 3852
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3852 -ip 3852
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3852 -ip 3852
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3852 -ip 3852
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3852 -ip 3852
1⤵
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-134-0x0000000002540000-0x0000000002640000-memory.dmp

Download

memory/3852-135-0x0000000004060000-0x00000000040A2000-memory.dmp

Download

memory/3852-136-0x0000000000400000-0x000000000230B000-memory.dmp

Download

memory/3852-140-0x0000000002540000-0x0000000002640000-memory.dmp

Download

memory/3852-143-0x0000000000400000-0x000000000230B000-memory.dmp

Download

memory/3852-144-0x0000000004060000-0x00000000040A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads