gcleaner | 8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2023, 02:56

Target
8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
Size 2.2MB
Sample230810-de7ccshc57
SHA256 8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1
MD5 0e8c733571f688560516057de6364927
SHA1 4e256ffaebb4d9b22f03c308e2ab4c55a29af1d6
SHA512 e8ba8e4995321031f9fc808a54da81c176e7cd836cdf5d0b95fa9167b8a9bd982efcabece117d57c87d3d34f89f8f4151d9dafe984c5749f7ea178ea9bbabf7d
SSDEEP 49152:curzWv9urK/urhur9furSurVurMwdurDhgkK3QqFFLnVOvOs:cur6lur8urhurZurSurVurrurDhgkK3i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Family

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Executes dropped EXE 1 IoCs

pid	Process
228	mvbD5xN6ZB24AH.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4060	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 228	4060	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	81
PID 4060 wrote to memory of 228	4060	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	81
PID 4060 wrote to memory of 228	4060	8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe	81

C:\Users\Admin\AppData\Local\Temp\8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe
"C:\Users\Admin\AppData\Local\Temp\8901b1e8af622a6c889085708bf39327ff3e93a22402b87187187d8c8f0e8cc1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\mvbD5xN6ZB24AH.exe
  2⤵
  - Executes dropped EXE
  PID:228

mvbD5xN6ZB24AH.exe

Path C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\mvbD5xN6ZB24AH.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mvbD5xN6ZB24AH.exe

Path C:\Users\Admin\AppData\Roaming\{2c34677b-19df-11ee-84b0-806e6f6e6963}\mvbD5xN6ZB24AH.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4060-133-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/4060-134-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/4060-135-0x0000000000400000-0x000000000143B000-memory.dmp

Download

memory/4060-140-0x0000000000400000-0x000000000143B000-memory.dmp

Download