Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
07-01-2024 18:07
General
-
Target
b11fa73625d6cba3dd6cf98467aea533.exe
-
Size
419KB
-
MD5
b11fa73625d6cba3dd6cf98467aea533
-
SHA1
004d3169fb9b2b6daeec6425f6da98c99a3b63e0
-
SHA256
d9cdd267e3c00ae4f70e60a45aa03f22b1a59b42526a692d0e5bde6b5f1b99d4
-
SHA512
2bba5cfaeec13bda9ffb03a16d1c2af9d85be0ec13b00d9f79e3c4ffbd334a7db00addb5b52b4f89a84a8a57349e29115d93532f866d37b9914c6b832247fdea
-
SSDEEP
6144:umHZ39YkgRaYfIIeWmfVjFsSX2/vwWJwQuuPkfwkaZeRJE1I7EOVqcEyrIXs:umHZ/cqx7sSX2nmQuSk7n8I4OVAyrI
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
web-stat.biz
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b11fa73625d6cba3dd6cf98467aea533.exe"C:\Users\Admin\AppData\Local\Temp\b11fa73625d6cba3dd6cf98467aea533.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 3002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1452 -ip 14521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
304KB