gcleaner | 5b7c58fb0a1cee2111ee220dd1273f467de8ca5dddff3e4a8d992a98557bb20e

General

Target

7502f3e13fd9416229f24c7f956bc21f.exe
Size

269KB
MD5

7502f3e13fd9416229f24c7f956bc21f
SHA1

fdc74c687a8e14624bcfbab3c81441d3364e88c3
SHA256

5b7c58fb0a1cee2111ee220dd1273f467de8ca5dddff3e4a8d992a98557bb20e
SHA512

4184acdae40f5e32533e0666a5f6813a2e8daef141862f6fbd4b63a66dbec7e439fa091a70a1ea5da36c7b1702ac6f728b726b78d9bdf9f9d1602247e932e245
SSDEEP

3072:NyFcpGHBJutqtZri91tkVcWNgvbiQQseHFd+xGLJ+v8rRRUh54F9UmgM:N+XutqDr61tTWmuQCYSrFtb

Score

10^/10

gcleaner kinsing onlylogger vidar loader stealer

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Kinsing
Kinsing is a loader written in Golang.
loader kinsing
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

OnlyLogger payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4256-2-0x0000000004910000-0x0000000004959000-memory.dmp	family_onlylogger
behavioral2/memory/4256-3-0x0000000000400000-0x0000000002CD2000-memory.dmp	family_onlylogger
behavioral2/memory/4256-5-0x0000000004910000-0x0000000004959000-memory.dmp	family_onlylogger
behavioral2/memory/4256-4-0x0000000000400000-0x0000000002CD2000-memory.dmp	family_onlylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7502f3e13fd9416229f24c7f956bc21f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	7502f3e13fd9416229f24c7f956bc21f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1560	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
4368	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
1124	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
1284	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
3416	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
2400	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe
4016	4256	WerFault.exe	7502f3e13fd9416229f24c7f956bc21f.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3004 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3004 taskkill.exe

pid	process
3004	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3004	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7502f3e13fd9416229f24c7f956bc21f.execmd.exe

description	pid	process	target process
PID 4256 wrote to memory of 2124	4256	7502f3e13fd9416229f24c7f956bc21f.exe	cmd.exe
PID 4256 wrote to memory of 2124	4256	7502f3e13fd9416229f24c7f956bc21f.exe	cmd.exe
PID 4256 wrote to memory of 2124	4256	7502f3e13fd9416229f24c7f956bc21f.exe	cmd.exe
PID 2124 wrote to memory of 3004	2124	cmd.exe	taskkill.exe
PID 2124 wrote to memory of 3004	2124	cmd.exe	taskkill.exe
PID 2124 wrote to memory of 3004	2124	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\7502f3e13fd9416229f24c7f956bc21f.exe
"C:\Users\Admin\AppData\Local\Temp\7502f3e13fd9416229f24c7f956bc21f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 724
2⤵
- Program crash
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 796
2⤵
- Program crash
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 920
2⤵
- Program crash
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 796
2⤵
- Program crash
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 920
2⤵
- Program crash
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 956
2⤵
- Program crash
PID:2400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "7502f3e13fd9416229f24c7f956bc21f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7502f3e13fd9416229f24c7f956bc21f.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "7502f3e13fd9416229f24c7f956bc21f.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 1136
2⤵
- Program crash
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4256 -ip 4256
1⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4256 -ip 4256
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4256 -ip 4256
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4256 -ip 4256
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4256 -ip 4256
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4256 -ip 4256
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4256 -ip 4256
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-1-0x0000000002F70000-0x0000000003070000-memory.dmp

Filesize
1024KB

Download
memory/4256-2-0x0000000004910000-0x0000000004959000-memory.dmp

Filesize
292KB

Download
memory/4256-3-0x0000000000400000-0x0000000002CD2000-memory.dmp

Filesize
40.8MB

Download
memory/4256-5-0x0000000004910000-0x0000000004959000-memory.dmp

Filesize
292KB

Download
memory/4256-4-0x0000000000400000-0x0000000002CD2000-memory.dmp

Filesize
40.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads