gcleaner | 608a5954935126b23854dccb0e9dccecac05692bddb60e40e1fa0e7e4a7da9ae

Analysis

max time kernel
123s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 19:52

Target

e326ac87b2d6ae4807f0d680f6dfa0ac_JaffaCakes118.exe
Size

256KB
MD5

e326ac87b2d6ae4807f0d680f6dfa0ac
SHA1

1ef221e827869688acd583b726e66fbe6c009f5f
SHA256

608a5954935126b23854dccb0e9dccecac05692bddb60e40e1fa0e7e4a7da9ae
SHA512

f6556d856e2a3192d54e578be0c28138c95056a8fa94c627b5fb9140032ca3c71ebce0409cb1439b0779964fe3cc898c9c2ef56dacefb176b21060141993b3ed
SSDEEP

3072:YmL6RqdS1qngrr04pry208anopQNytUk3PgZhalO6Ryr8a4RO4mCZAQ:YmLfO04BY7NeUk3PMdnOROjCi

Score

10^/10

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-2-0x00000000003B0000-0x00000000003E0000-memory.dmp	family_onlylogger
behavioral1/memory/1736-3-0x0000000000400000-0x0000000002CCE000-memory.dmp	family_onlylogger
behavioral1/memory/1736-15-0x0000000000400000-0x0000000002CCE000-memory.dmp	family_onlylogger

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

C:\Users\Admin\AppData\Local\Temp\e326ac87b2d6ae4807f0d680f6dfa0ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e326ac87b2d6ae4807f0d680f6dfa0ac_JaffaCakes118.exe"
1⤵
PID:1736

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1736-1-0x0000000003110000-0x0000000003210000-memory.dmp

Filesize
1024KB

Download
memory/1736-2-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download
memory/1736-3-0x0000000000400000-0x0000000002CCE000-memory.dmp

Filesize
40.8MB

Download
memory/1736-15-0x0000000000400000-0x0000000002CCE000-memory.dmp

Filesize
40.8MB

Download