gcleaner | 7b1cf1979579775f48e8d20974753453f75963b3094d3b95519d9362e943dbbb

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:58

Target

mixseven.exe
Size

313KB
MD5

e2b46439ae09a3b7a4250d848c7b7265
SHA1

b1dd7e352c779651fcce756e0a4a6d78ac08c87a
SHA256

e0c8cc8c66b2d57aa27efa5eb8be1331934645b12bfbe26c5fdab271f1c94bc4
SHA512

e5d419bd44b94b521ae8e63d90b3c3621288063dbfc908d50826e857abb61b512fd4a677f4d8e281b54c3cc105c8b8dc49459a4eaae42e4b4fc935fda0d1df31
SSDEEP

6144:keKv6F664O2/Oex5YpKQsR0POMAwmNoTUHvRwWLJNVst+SOTx1:5w64J/OjpAR8pfTUPRwaqtI

Score

10^/10

Family

gcleaner

194.145.227.161

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 5 IoCs

resource	yara_rule
behavioral26/memory/1396-2-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral26/memory/1396-3-0x0000000000400000-0x0000000000534000-memory.dmp	family_onlylogger
behavioral26/memory/1396-7-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral26/memory/1396-16-0x0000000000400000-0x0000000000534000-memory.dmp	family_onlylogger
behavioral26/memory/1396-17-0x0000000000400000-0x0000000000534000-memory.dmp	family_onlylogger

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4304	1396	WerFault.exe	83
4900	1396	WerFault.exe	83
1504	1396	WerFault.exe	83
696	1396	WerFault.exe	83
2400	1396	WerFault.exe	83
4800	1396	WerFault.exe	83
4676	1396	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\mixseven.exe
"C:\Users\Admin\AppData\Local\Temp\mixseven.exe"
1⤵
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 624
  2⤵
  - Program crash
  PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 660
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 744
  2⤵
  - Program crash
  PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 628
  2⤵
  - Program crash
  PID:696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 856
  2⤵
  - Program crash
  PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1016
  2⤵
  - Program crash
  PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1028
  2⤵
  - Program crash
  PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1396 -ip 1396
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1396 -ip 1396
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1396 -ip 1396
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1396 -ip 1396
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1396 -ip 1396
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1396 -ip 1396
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1396 -ip 1396
1⤵
PID:4404

memory/1396-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/1396-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1396-3-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1396-6-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/1396-7-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1396-16-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1396-17-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download