Analysis
-
max time kernel
88s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
-
submitted
07/01/2024, 18:07 UTC
General
-
Target
084867eab2023c445721b0cd205ce47a.exe
-
Size
419KB
-
MD5
084867eab2023c445721b0cd205ce47a
-
SHA1
0f465ee53425b4c9a963f6ecfe1119840fa810d7
-
SHA256
5d9dc24f2de724f0921574f0589d39f79cbdd85cc817a6345267aa9aa9632a2b
-
SHA512
58ec053935a7d8e2f206f3ecf76ab575dcf95736f1f23c2b8944ff4e5c31b3f6faaef20cd959a8206003c298e82770f456261a3122f815dd6347f08dd1992c3c
-
SSDEEP
6144:pryICqvsNS64vmvH3uSlMe1DjJY4aUWXCZnMDHzfA2PjdlIJfD0:pryIC2SHhMexi48y1MDTfA2dlq
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
web-stat.biz
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\084867eab2023c445721b0cd205ce47a.exe"C:\Users\Admin\AppData\Local\Temp\084867eab2023c445721b0cd205ce47a.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 2642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2248 -ip 22481⤵
Network
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
52.111.243.31:443
-
8.8.8.8:5343.229.111.52.in-addr.arpadns
DNS Request
43.229.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
304KB