gcleaner | 12dce7aaaec1286f50bfbc7b5df7ad050ec5df44fb786be36e11ec582053e0a7

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49641e156e35418f639ebdfe60d5fe6a.exe
Size 291KB
Sample231222-b28gtsfde7
SHA256 12dce7aaaec1286f50bfbc7b5df7ad050ec5df44fb786be36e11ec582053e0a7
MD5 49641e156e35418f639ebdfe60d5fe6a
SHA1 3318f6724fdf98f8e6be0ef8e1596f10e5d18bb8
SHA512 f0065689cec947651a9029f06af2a03122b962a648d48fe921d5ac595c851c43e7ac951541b3972bbac76b4861cc4845d65b2b19e6ac1be19ac8c6feb049ef6a
SSDEEP 6144:unQtDyG4inD5cgLQl6oQsCoU1UU/TzdRDoFQ7qaz0:xtDR445cgroQ32ULzdhooV0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

194.145.227.161

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral2/memory/976-2-0x0000000002C30000-0x0000000002C5F000-memory.dmp	family_onlylogger
behavioral2/memory/976-3-0x0000000000400000-0x0000000002B53000-memory.dmp	family_onlylogger
behavioral2/memory/976-4-0x0000000000400000-0x0000000002B53000-memory.dmp	family_onlylogger
behavioral2/memory/976-7-0x0000000002C30000-0x0000000002C5F000-memory.dmp	family_onlylogger

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4836	976	WerFault.exe	15
2116	976	WerFault.exe	15
4460	976	WerFault.exe	15
664	976	WerFault.exe	15
4592	976	WerFault.exe	15
896	976	WerFault.exe	15
744	976	WerFault.exe	15
4132	976	WerFault.exe	15

C:\Users\Admin\AppData\Local\Temp\49641e156e35418f639ebdfe60d5fe6a.exe
"C:\Users\Admin\AppData\Local\Temp\49641e156e35418f639ebdfe60d5fe6a.exe"
1⤵
PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 624
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 664
  2⤵
  - Program crash
  PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 748
  2⤵
  - Program crash
  PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 768
  2⤵
  - Program crash
  PID:664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 860
  2⤵
  - Program crash
  PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 924
  2⤵
  - Program crash
  PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1072
  2⤵
  - Program crash
  PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 920
  2⤵
  - Program crash
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 976 -ip 976
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 976 -ip 976
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 976 -ip 976
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 976 -ip 976
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 976 -ip 976
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 976 -ip 976
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 976 -ip 976
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 976 -ip 976
1⤵
PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-2-0x0000000002C30000-0x0000000002C5F000-memory.dmp

Download

memory/976-1-0x0000000002C60000-0x0000000002D60000-memory.dmp

Download

memory/976-3-0x0000000000400000-0x0000000002B53000-memory.dmp

Download

memory/976-4-0x0000000000400000-0x0000000002B53000-memory.dmp

Download

memory/976-7-0x0000000002C30000-0x0000000002C5F000-memory.dmp

Download

memory/976-6-0x0000000002C60000-0x0000000002D60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads