Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
19-03-2024 02:48
General
-
Target
d504cad5bcba47048c388333885f9f13.exe
-
Size
305KB
-
MD5
d504cad5bcba47048c388333885f9f13
-
SHA1
33e362573da735358b0376e786d948f5a633286f
-
SHA256
ca21f244e68de897460be7c7cf7ef53370fef13e49c8bab870d6a67702a1afef
-
SHA512
b0c58fec3dae3b919c8f937028927cc00f38c8396a861166b585d706f628c0fe5f24500e05b921578083519ed49b93426c916c71d7e46f85ceedefbd3ded1897
-
SSDEEP
6144:TpLFJZvPqVlL0Nm4wvIHkkgFVg8uNsIY6xA:TphJ43IevPBhB
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
194.145.227.161
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d504cad5bcba47048c388333885f9f13.exe"C:\Users\Admin\AppData\Local\Temp\d504cad5bcba47048c388333885f9f13.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-2-0x00000000001B0000-0x00000000001DF000-memory.dmpFilesize
188KB
-
memory/2292-1-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/2292-3-0x0000000000400000-0x0000000001D99000-memory.dmpFilesize
25.6MB
-
memory/2292-4-0x0000000000400000-0x0000000001D99000-memory.dmpFilesize
25.6MB
-
memory/2292-5-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB