Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
07/01/2024, 18:07
General
-
Target
379ebead1fb22627691fbd82cdc97817.exe
-
Size
425KB
-
MD5
379ebead1fb22627691fbd82cdc97817
-
SHA1
9c8d1836d857ea0368fcc882b6b089900f203e08
-
SHA256
1a10164e5cdc3ddbc96e75468254a421b1646b24934a6bde3313229fc6f26f0e
-
SHA512
1be3d939a8dbb1a8bb44d56239aa1474e7f0123b40289747a3a0bb7dfc9fb0a581dca0752f6d26518e7d9e745d654e52a82809cec1afbafb285a044f6cae728c
-
SSDEEP
6144:0JEb+g8Yjk5egDV4jDfi0swLwn94drMZMY5/Ge9aPcziZnJ37Lf1Ik5eLe9g:cESg/k5eYaXLIXZMc9TW1J3Xfn5e
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
web-stat.biz
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\379ebead1fb22627691fbd82cdc97817.exe"C:\Users\Admin\AppData\Local\Temp\379ebead1fb22627691fbd82cdc97817.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 3002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4844 -ip 48441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
304KB