gcleaner | 6c466098bf56b4a674922a48479930a2282f0a87c1156e97d6f3491a0872840e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148d44350c2edaef20758f0c1aa74bd4.exe
Size 556KB
Sample240101-ygc7hsbbc4
SHA256 6c466098bf56b4a674922a48479930a2282f0a87c1156e97d6f3491a0872840e
MD5 148d44350c2edaef20758f0c1aa74bd4
SHA1 d2dd6c3ca6830c6cd168ef68ba496d6c87cf022f
SHA512 de1bd35211f9c0287977843f45d88a67ceea92bfa95cb31839c06802b980f47d3709f99afa4feac4a081cd4f1a6f3afa464e3075c726528c50768cf0f79f67c2
SSDEEP 12288:WLKFKqvz3CehLSO+YjN43jRPoZNmjvN+Bc70phMtwTk1:Mqvz7+YyVPo+vP48V1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

194.145.227.161

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral2/memory/4368-2-0x0000000004110000-0x000000000413F000-memory.dmp	family_onlylogger
behavioral2/memory/4368-3-0x0000000000400000-0x00000000023BA000-memory.dmp	family_onlylogger
behavioral2/memory/4368-4-0x0000000000400000-0x00000000023BA000-memory.dmp	family_onlylogger
behavioral2/memory/4368-7-0x0000000004110000-0x000000000413F000-memory.dmp	family_onlylogger

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3644	4368	WerFault.exe	26
3224	4368	WerFault.exe	26
4188	4368	WerFault.exe	26
1604	4368	WerFault.exe	26
1040	4368	WerFault.exe	26
60	4368	WerFault.exe	26
692	4368	WerFault.exe	26
548	4368	WerFault.exe	26

C:\Users\Admin\AppData\Local\Temp\148d44350c2edaef20758f0c1aa74bd4.exe
"C:\Users\Admin\AppData\Local\Temp\148d44350c2edaef20758f0c1aa74bd4.exe"
1⤵
PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 636
  2⤵
  - Program crash
  PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 656
  2⤵
  - Program crash
  PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 664
  2⤵
  - Program crash
  PID:4188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 800
  2⤵
  - Program crash
  PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 796
  2⤵
  - Program crash
  PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1020
  2⤵
  - Program crash
  PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1032
  2⤵
  - Program crash
  PID:692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1180
  2⤵
  - Program crash
  PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4368 -ip 4368
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4368 -ip 4368
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4368 -ip 4368
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4368 -ip 4368
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4368 -ip 4368
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4368 -ip 4368
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4368 -ip 4368
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4368 -ip 4368
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4368 -ip 4368
1⤵
PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4368-1-0x0000000002670000-0x0000000002770000-memory.dmp

Download

memory/4368-2-0x0000000004110000-0x000000000413F000-memory.dmp

Download

memory/4368-3-0x0000000000400000-0x00000000023BA000-memory.dmp

Download

memory/4368-4-0x0000000000400000-0x00000000023BA000-memory.dmp

Download

memory/4368-6-0x0000000002670000-0x0000000002770000-memory.dmp

Download

memory/4368-7-0x0000000004110000-0x000000000413F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads