gcleaner | 5da298225dc154020cd20cfcdda68516076bba1d8a1d0265f6d2839f9e8abd51

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d85ab9d2949b8d44542174d6bb8d5ba.exe
Size 309KB
Sample231222-fpnn4sgcep
SHA256 5da298225dc154020cd20cfcdda68516076bba1d8a1d0265f6d2839f9e8abd51
MD5 6d85ab9d2949b8d44542174d6bb8d5ba
SHA1 8c548480859f61a5ff71541d3f34b8cb0cb25d72
SHA512 addc7d4bea803f55bc5d3d00f171a46d3ec9eb5f661d1d6967cb2eda325e40728a0fa5a5dad5fb55500a7509053ada05b6cc6a2068800fa06d07d127728fa17a
SSDEEP 6144:jfNhF/Q+jKt6iimP4nxdhpjv2qmDyM0/FqEgBYCLm4Uk0VFex:XNQkKt6iB4nxHpjeeM0/FlgBY2m4R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

194.145.227.161

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral2/memory/920-2-0x00000000048A0000-0x00000000048CF000-memory.dmp	family_onlylogger
behavioral2/memory/920-3-0x0000000000400000-0x0000000002B59000-memory.dmp	family_onlylogger
behavioral2/memory/920-4-0x0000000000400000-0x0000000002B59000-memory.dmp	family_onlylogger
behavioral2/memory/920-7-0x00000000048A0000-0x00000000048CF000-memory.dmp	family_onlylogger

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3132	920	WerFault.exe	86
4488	920	WerFault.exe	86
4616	920	WerFault.exe	86
816	920	WerFault.exe	86
1336	920	WerFault.exe	86
760	920	WerFault.exe	86
3420	920	WerFault.exe	86
2016	920	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\6d85ab9d2949b8d44542174d6bb8d5ba.exe
"C:\Users\Admin\AppData\Local\Temp\6d85ab9d2949b8d44542174d6bb8d5ba.exe"
1⤵
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 620
  2⤵
  - Program crash
  PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 656
  2⤵
  - Program crash
  PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 656
  2⤵
  - Program crash
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 648
  2⤵
  - Program crash
  PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 856
  2⤵
  - Program crash
  PID:1336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1016
  2⤵
  - Program crash
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1088
  2⤵
  - Program crash
  PID:3420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1020
  2⤵
  - Program crash
  PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 920 -ip 920
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 920 -ip 920
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 920 -ip 920
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 920 -ip 920
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 920 -ip 920
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 920 -ip 920
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 920 -ip 920
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 920 -ip 920
1⤵
PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-1-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

Download

memory/920-2-0x00000000048A0000-0x00000000048CF000-memory.dmp

Download

memory/920-3-0x0000000000400000-0x0000000002B59000-memory.dmp

Download

memory/920-4-0x0000000000400000-0x0000000002B59000-memory.dmp

Download

memory/920-6-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

Download

memory/920-7-0x00000000048A0000-0x00000000048CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads