gcleaner | 6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad

Analysis

max time kernel
147s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 16:48

Target
6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
Size 2.4MB
Sample231012-vbbjyscc31
SHA256 6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad
MD5 64e876cb4995a05a4fcc9942da36f1c5
SHA1 4007e68ca9eb7da041c3110f837d547aedc4c7a9
SHA512 1abc2b4ee7f8378f79ad1ef0e56b8b6b291f0065713d780ba95a0e870f01795b7b6c3296f6f47709c7857e12cbb4436fc802a232ede69136d52d72cf361b4bf2
SSDEEP 24576:pzyW0zy4rzy2hzyxzyYzy7rwzymzy+cFGu7XyGW1G4dPApPWLg0RPtdyzAFQTEbm:+5lrNFGu7XyGx4ndy82ay7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Family

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Executes dropped EXE 1 IoCs

pid	Process
4740	h9xsE.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4740	812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe	83
PID 812 wrote to memory of 4740	812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe	83
PID 812 wrote to memory of 4740	812	6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe	83

C:\Users\Admin\AppData\Local\Temp\6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe
"C:\Users\Admin\AppData\Local\Temp\6b2d271b3ef6a2c8f872daa35eeb7bffe526809f9daf9c881662685bbf5aadad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Roaming\{fc399840-53d0-11ee-9774-806e6f6e6963}\h9xsE.exe
  2⤵
  - Executes dropped EXE
  PID:4740

h9xsE.exe

Path C:\Users\Admin\AppData\Roaming\{fc399840-53d0-11ee-9774-806e6f6e6963}\h9xsE.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

h9xsE.exe

Path C:\Users\Admin\AppData\Roaming\{fc399840-53d0-11ee-9774-806e6f6e6963}\h9xsE.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/812-1-0x0000000000400000-0x0000000001464000-memory.dmp

Download

memory/812-0-0x0000000000400000-0x0000000001464000-memory.dmp

Download

memory/812-2-0x0000000000400000-0x0000000001464000-memory.dmp

Download

memory/812-7-0x0000000000400000-0x0000000001464000-memory.dmp

Download