gcleaner | 24e05c6c8e0e360207b94dd932bf57a5b0bc4b6a9e4ca72964ffe64c731956a1

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 17:09

Target

5941ecae13f8fec59620321dfa31d3cc.exe
Size

323KB
MD5

5941ecae13f8fec59620321dfa31d3cc
SHA1

c70bb8b9db75b34e1f52d0368ba015ad61c06221
SHA256

24e05c6c8e0e360207b94dd932bf57a5b0bc4b6a9e4ca72964ffe64c731956a1
SHA512

a66699e82745e9c10c0e0e660cf7f7e96dad7a4fa79e29e61cafa6cb3e22331e9203560ecfc8d4a3ed965377c0b41d9ac8550a74e877e7da70c4597b1801f7c9
SSDEEP

6144:gbaeJBcuZLM9W2OaTJcU2n7M27rT/roxuCCqu9WM3c:MfcudM9W8TJcd7M27XTo8Cj

Score

10^/10

Family

gcleaner

194.145.227.161

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 5 IoCs

resource	yara_rule
behavioral2/memory/4672-2-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral2/memory/4672-3-0x0000000000400000-0x00000000023BB000-memory.dmp	family_onlylogger
behavioral2/memory/4672-7-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral2/memory/4672-18-0x0000000000400000-0x00000000023BB000-memory.dmp	family_onlylogger
behavioral2/memory/4672-19-0x0000000000400000-0x00000000023BB000-memory.dmp	family_onlylogger

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4952	4672	WerFault.exe	86
1164	4672	WerFault.exe	86
4820	4672	WerFault.exe	86
1708	4672	WerFault.exe	86
4128	4672	WerFault.exe	86
4164	4672	WerFault.exe	86
4748	4672	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\5941ecae13f8fec59620321dfa31d3cc.exe
"C:\Users\Admin\AppData\Local\Temp\5941ecae13f8fec59620321dfa31d3cc.exe"
1⤵
PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 456
  2⤵
  - Program crash
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 636
  2⤵
  - Program crash
  PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 672
  2⤵
  - Program crash
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 652
  2⤵
  - Program crash
  PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 748
  2⤵
  - Program crash
  PID:4128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1012
  2⤵
  - Program crash
  PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1072
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4672 -ip 4672
1⤵
PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4672 -ip 4672
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4672 -ip 4672
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4672 -ip 4672
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4672 -ip 4672
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4672 -ip 4672
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4672 -ip 4672
1⤵
PID:1980

memory/4672-1-0x0000000002460000-0x0000000002560000-memory.dmp

Filesize
1024KB

Download
memory/4672-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/4672-3-0x0000000000400000-0x00000000023BB000-memory.dmp

Filesize
31.7MB

Download
memory/4672-6-0x0000000002460000-0x0000000002560000-memory.dmp

Filesize
1024KB

Download
memory/4672-7-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/4672-18-0x0000000000400000-0x00000000023BB000-memory.dmp

Filesize
31.7MB

Download
memory/4672-19-0x0000000000400000-0x00000000023BB000-memory.dmp

Filesize
31.7MB

Download