Overview

overview

10

Static

static

3

3eaac65b08...8c.exe

windows7-x64

10

3eaac65b08...8c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 14:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3eaac65b08a1d062a8213e02a5c1d08c.exe
  • Size 307KB
  • Sample240103-r5csbsfafk
  • SHA256 0edd0597188e359258b775a5dcd232351c7c7482ae1ae17aeb2c92c42293bbf7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gcleaneronlyloggerloader

Malware Config

Extracted

Family

  • gcleaner

C2

  • 194.145.227.161

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger
  • OnlyLogger payload 4 IoCs
  • Program crash 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3eaac65b08a1d062a8213e02a5c1d08c.exe
    "C:\Users\Admin\AppData\Local\Temp\3eaac65b08a1d062a8213e02a5c1d08c.exe"
    1⤵
      PID:5028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 472
        2⤵
        • Program crash
        PID:4272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 732
        2⤵
        • Program crash
        PID:4108
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 908
        2⤵
        • Program crash
        PID:3452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 904
        2⤵
        • Program crash
        PID:3132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 948
        2⤵
        • Program crash
        PID:3428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 972
        2⤵
        • Program crash
        PID:3060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1152
        2⤵
        • Program crash
        PID:3684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1212
        2⤵
        • Program crash
        PID:4312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 708
        2⤵
        • Program crash
        PID:3392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1148
        2⤵
        • Program crash
        PID:3288
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5028 -ip 5028
      1⤵
        PID:3912
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 5028
        1⤵
          PID:3648
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5028 -ip 5028
          1⤵
            PID:1396
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5028 -ip 5028
            1⤵
              PID:3032
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5028 -ip 5028
              1⤵
                PID:5016
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5028 -ip 5028
                1⤵
                  PID:1896
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5028 -ip 5028
                  1⤵
                    PID:3700
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5028 -ip 5028
                    1⤵
                      PID:4788
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5028 -ip 5028
                      1⤵
                        PID:4732
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5028 -ip 5028
                        1⤵
                          PID:3372

                        Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              memory/5028-1-0x0000000002630000-0x0000000002730000-memory.dmp
                              Download

                              memory/5028-2-0x0000000003FD0000-0x0000000003FFF000-memory.dmp
                              Download

                              memory/5028-3-0x0000000000400000-0x00000000023B6000-memory.dmp
                              Download

                              memory/5028-4-0x0000000000400000-0x00000000023B6000-memory.dmp
                              Download

                              memory/5028-7-0x0000000003FD0000-0x0000000003FFF000-memory.dmp
                              Download

                              memory/5028-6-0x0000000002630000-0x0000000002730000-memory.dmp
                              Download