gcleaner | 7527ca1a945babb9d1122c98c466d0b122300a6bde28e32750d3d3d7416a2f1a

Analysis

max time kernel
10s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2023, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8942003646174e29e455a555fbc94cb.exe
Size 300KB
Sample231227-2g23esacd2
SHA256 7527ca1a945babb9d1122c98c466d0b122300a6bde28e32750d3d3d7416a2f1a
MD5 b8942003646174e29e455a555fbc94cb
SHA1 4ed0eafc8841684708ab64c360e4d8047f2b4a1d
SHA512 1717161f805432e90dfb59cb9cd8c1a0c10850f4fbb1ed5d03ba78738bd49feffd5e704f67f7b2620bc51c9d34fa6e0fd966fbdd9942f4f8ac64e950593d6ac5
SSDEEP 6144:Gr1TCrxzJnkTi/veYQsHGLY1LyXjlrFzBnmytldWgy:Gr1TCnk+3yMVyzLhm2ld
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

g-prtnrs.top
g-prtrs.top

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

resource	yara_rule
behavioral2/memory/2988-2-0x0000000002C00000-0x0000000002C2E000-memory.dmp	family_onlylogger
behavioral2/memory/2988-3-0x0000000000400000-0x0000000002B90000-memory.dmp	family_onlylogger
behavioral2/memory/2988-4-0x0000000000400000-0x0000000002B90000-memory.dmp	family_onlylogger

Program crash 12 IoCs

pid	pid_target	Process	procid_target
4928	2988	WerFault.exe	16
4588	2988	WerFault.exe	16
872	2988	WerFault.exe	16
3300	2988	WerFault.exe	16
3148	2988	WerFault.exe	16
392	2988	WerFault.exe	16
1576	2988	WerFault.exe	16
2484	2988	WerFault.exe	16
3228	2988	WerFault.exe	16
4748	2988	WerFault.exe	16
4524	2988	WerFault.exe	16
932	2988	WerFault.exe	16

C:\Users\Admin\AppData\Local\Temp\b8942003646174e29e455a555fbc94cb.exe
"C:\Users\Admin\AppData\Local\Temp\b8942003646174e29e455a555fbc94cb.exe"
1⤵
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 468
  2⤵
  - Program crash
  PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 648
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 704
  2⤵
  - Program crash
  PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 708
  2⤵
  - Program crash
  PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 948
  2⤵
  - Program crash
  PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 972
  2⤵
  - Program crash
  PID:392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1032
  2⤵
  - Program crash
  PID:1576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 832
  2⤵
  - Program crash
  PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1168
  2⤵
  - Program crash
  PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1236
  2⤵
  - Program crash
  PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1508
  2⤵
  - Program crash
  PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1172
  2⤵
  - Program crash
  PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2988 -ip 2988
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2988 -ip 2988
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2988 -ip 2988
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2988 -ip 2988
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2988 -ip 2988
1⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2988 -ip 2988
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2988 -ip 2988
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2988 -ip 2988
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2988 -ip 2988
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2988 -ip 2988
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2988 -ip 2988
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2988 -ip 2988
1⤵
PID:3632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-2-0x0000000002C00000-0x0000000002C2E000-memory.dmp

Download

memory/2988-1-0x0000000002CC0000-0x0000000002DC0000-memory.dmp

Download

memory/2988-3-0x0000000000400000-0x0000000002B90000-memory.dmp

Download

memory/2988-4-0x0000000000400000-0x0000000002B90000-memory.dmp

Download

memory/2988-5-0x0000000002CC0000-0x0000000002DC0000-memory.dmp

Download

memory/2988-7-0x0000000002C00000-0x0000000002C2E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads