gcleaner | ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb

Resubmissions

07/01/2024, 18:07

240107-wqjpjscef510

15/01/2022, 08:34

220115-kgnrcsdggm7

Analysis

max time kernel
142s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
07/01/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
425b312c607eaa405059b4928a65cba8.exe
Size 420KB
Sample240107-wqjpjscef5
SHA256 ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb
MD5 425b312c607eaa405059b4928a65cba8
SHA1 3caefbcad6d742e8c1849ec2d8ce092c0c75152f
SHA512 89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6
SSDEEP 12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

web-stat.biz

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 1 IoCs

resource	yara_rule
behavioral4/memory/1476-2-0x0000000002410000-0x000000000245C000-memory.dmp	family_onlylogger

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4828	1476	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\425b312c607eaa405059b4928a65cba8.exe
"C:\Users\Admin\AppData\Local\Temp\425b312c607eaa405059b4928a65cba8.exe"
1⤵
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 240
  2⤵
  - Program crash
  PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1476 -ip 1476
1⤵
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-1-0x0000000000830000-0x0000000000930000-memory.dmp

Download

memory/1476-2-0x0000000002410000-0x000000000245C000-memory.dmp