gcleaner | 8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10/08/2023, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
Size 2.2MB
Sample230810-de7ccshc57
SHA256 8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1
MD5 0e8c733571f688560516057de6364927
SHA1 4e256ffaebb4d9b22f03c308e2ab4c55a29af1d6
SHA512 e8ba8e4995321031f9fc808a54da81c176e7cd836cdf5d0b95fa9167b8a9bd982efcabece117d57c87d3d34f89f8f4151d9dafe984c5749f7ea178ea9bbabf7d
SSDEEP 49152:curzWv9urK/urhur9furSurVurMwdurDhgkK3QqFFLnVOvOs:cur6lur8urhurZurSurVurrurDhgkK3i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75

Attributes

url_path
/default/puk.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Executes dropped EXE 1 IoCs

pid	Process
1484	BQW9ul2.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1484	2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	30
PID 2400 wrote to memory of 1484	2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	30
PID 2400 wrote to memory of 1484	2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	30
PID 2400 wrote to memory of 1484	2400	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	30

C:\Users\Admin\AppData\Local\Temp\8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
"C:\Users\Admin\AppData\Local\Temp\8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\BQW9ul2.exe
  2⤵
  - Executes dropped EXE
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BQW9ul2.exe

Path C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\BQW9ul2.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

BQW9ul2.exe

Path \Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\BQW9ul2.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2400-54-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/2400-55-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/2400-56-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/2400-62-0x0000000000400000-0x000000000143B000-memory.dmp

Download