gcleaner | f211d8be8001df12bba948be8bdb8db9c938a518052a50d358d02a04396c2dd5

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe
Size

281KB
MD5

e7670118fd4bd720b70a799bc68860b9
SHA1

5bc054649f120473e2e022ba0e628c20649724e8
SHA256

f211d8be8001df12bba948be8bdb8db9c938a518052a50d358d02a04396c2dd5
SHA512

9f2edecedf05e2d0dc83e1932910bca94bf1878643719aacfc1e04d96b6702a12400b0f9259db01c46e920963293907edab12e575476f06f459c965ce8292e1c
SSDEEP

6144:6dk2Sqt6RT2VN8ODCQKvZLBAyPEhUad4eGsU9eR:v2d6R6VN8ODqBLS+9ad4egeR

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

gc-prtnrs.top

gcc-prtnrs.top

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral2/memory/3420-2-0x0000000002220000-0x000000000224E000-memory.dmp	family_onlylogger
behavioral2/memory/3420-3-0x0000000000400000-0x00000000004CA000-memory.dmp	family_onlylogger
behavioral2/memory/3420-4-0x0000000000400000-0x00000000004CA000-memory.dmp	family_onlylogger
behavioral2/memory/3420-7-0x0000000002220000-0x000000000224E000-memory.dmp	family_onlylogger

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1020	3420	WerFault.exe	84
812	3420	WerFault.exe	84
4356	3420	WerFault.exe	84
4620	3420	WerFault.exe	84
2980	3420	WerFault.exe	84
1504	3420	WerFault.exe	84
3036	3420	WerFault.exe	84
4444	3420	WerFault.exe	84
380	3420	WerFault.exe	84
3904	3420	WerFault.exe	84
3836	3420	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe"
1⤵
PID:3420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 460
  2⤵
  - Program crash
  PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 652
  2⤵
  - Program crash
  PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 680
  2⤵
  - Program crash
  PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 828
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 872
  2⤵
  - Program crash
  PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1020
  2⤵
  - Program crash
  PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1168
  2⤵
  - Program crash
  PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1172
  2⤵
  - Program crash
  PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1428
  2⤵
  - Program crash
  PID:380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 844
  2⤵
  - Program crash
  PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1708
  2⤵
  - Program crash
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3420 -ip 3420
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3420 -ip 3420
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3420 -ip 3420
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3420 -ip 3420
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3420 -ip 3420
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3420 -ip 3420
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3420 -ip 3420
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3420 -ip 3420
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3420 -ip 3420
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3420 -ip 3420
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3420 -ip 3420
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3420-1-0x0000000000780000-0x0000000000880000-memory.dmp

Filesize
1024KB

Download
memory/3420-2-0x0000000002220000-0x000000000224E000-memory.dmp

Filesize
184KB

Download
memory/3420-3-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3420-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3420-7-0x0000000002220000-0x000000000224E000-memory.dmp

Filesize
184KB

Download
memory/3420-6-0x0000000000780000-0x0000000000880000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads