gcleaner | 2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2023, 21:40

Target
2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
Size 1.6MB
Sample230810-1jbgtaba4z
SHA256 2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8
MD5 396a9436b717ad83907cae9218f4a5b4
SHA1 f4427723f39d75df0a1884382a9857896899778c
SHA512 7c43f942ea86d89096692e0c25ff0d9338d5c1c8eac5b78431768133cb9e67d10fba808f394dc7b641e077ef93b6456e43dab8a060bae227d087142d4bec2615
SSDEEP 49152:PDD2VSb1+/zSvwpMMMMMMMMbMMMMMMMMmkAm4ihReOt:rD2kbuOvwpMMMMMMMMbMMMMMMMM6m4in
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Family

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Executes dropped EXE 1 IoCs

pid	Process
1908	lUxsz13kX.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1908	1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe	80
PID 1512 wrote to memory of 1908	1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe	80
PID 1512 wrote to memory of 1908	1512	2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe	80

C:\Users\Admin\AppData\Local\Temp\2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe
"C:\Users\Admin\AppData\Local\Temp\2c53ca01340b4cc10484f28abbbd4c7c0e899b0e228de0e298d6a4ddff5e7eb8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\lUxsz13kX.exe
  2⤵
  - Executes dropped EXE
  PID:1908

lUxsz13kX.exe

Path C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\lUxsz13kX.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUxsz13kX.exe

Path C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\lUxsz13kX.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-133-0x0000000000400000-0x0000000001398000-memory.dmp

Download

memory/1512-134-0x0000000000400000-0x0000000001398000-memory.dmp

Download

memory/1512-135-0x0000000000400000-0x0000000001398000-memory.dmp

Download

memory/1512-140-0x0000000000400000-0x0000000001398000-memory.dmp

Download