gcleaner | 2dbb3995c69507673adcf7043e544522cb6366775175ecb0484b08c15627de89

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51cb1ae07df1907d00b2fd335255da8f.exe
Size 363KB
Sample231222-cta22afhcp
SHA256 2dbb3995c69507673adcf7043e544522cb6366775175ecb0484b08c15627de89
MD5 51cb1ae07df1907d00b2fd335255da8f
SHA1 66d8386e97f70ab401b893aa8cdc53e1fdfef737
SHA512 be29726c43140f197ce3cfae2a2b0bf7b4000556b23570c836236d2389abec4de7b528a7cf752269215ddc87ff9f44476385fc81c5931c56fe1f37a7ef89c0ea
SSDEEP 6144:RkJGFKxTuCdruNrE8+pnqD59F751g/hsWsHrmQnU5INUoGNNk:NoxTXdruS8+pnk5bOhbkrmp8UnN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

194.145.227.161

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral2/memory/3740-2-0x0000000004770000-0x00000000047B8000-memory.dmp	family_onlylogger
behavioral2/memory/3740-3-0x0000000000400000-0x0000000002B66000-memory.dmp	family_onlylogger
behavioral2/memory/3740-4-0x0000000000400000-0x0000000002B66000-memory.dmp	family_onlylogger
behavioral2/memory/3740-5-0x0000000004770000-0x00000000047B8000-memory.dmp	family_onlylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	51cb1ae07df1907d00b2fd335255da8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1156	3740	WerFault.exe	16
1932	3740	WerFault.exe	16
1536	3740	WerFault.exe	16
2144	3740	WerFault.exe	16
3608	3740	WerFault.exe	16
3364	3740	WerFault.exe	16
1784	3740	WerFault.exe	16

Kills process with taskkill 1 IoCs

evasion

pid	Process
3908	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2600	3740	51cb1ae07df1907d00b2fd335255da8f.exe	108
PID 3740 wrote to memory of 2600	3740	51cb1ae07df1907d00b2fd335255da8f.exe	108
PID 3740 wrote to memory of 2600	3740	51cb1ae07df1907d00b2fd335255da8f.exe	108
PID 2600 wrote to memory of 3908	2600	cmd.exe	109
PID 2600 wrote to memory of 3908	2600	cmd.exe	109
PID 2600 wrote to memory of 3908	2600	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\51cb1ae07df1907d00b2fd335255da8f.exe
"C:\Users\Admin\AppData\Local\Temp\51cb1ae07df1907d00b2fd335255da8f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 724
  2⤵
  - Program crash
  PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 812
  2⤵
  - Program crash
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 920
  2⤵
  - Program crash
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 784
  2⤵
  - Program crash
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 784
  2⤵
  - Program crash
  PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 948
  2⤵
  - Program crash
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "51cb1ae07df1907d00b2fd335255da8f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\51cb1ae07df1907d00b2fd335255da8f.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "51cb1ae07df1907d00b2fd335255da8f.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 976
  2⤵
  - Program crash
  PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3740 -ip 3740
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3740 -ip 3740
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3740 -ip 3740
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3740 -ip 3740
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3740 -ip 3740
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3740 -ip 3740
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3740 -ip 3740
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3740-2-0x0000000004770000-0x00000000047B8000-memory.dmp

Download

memory/3740-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

Download

memory/3740-3-0x0000000000400000-0x0000000002B66000-memory.dmp

Download

memory/3740-4-0x0000000000400000-0x0000000002B66000-memory.dmp

Download

memory/3740-5-0x0000000004770000-0x00000000047B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads