gcleaner | 44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e

General

Target

44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe
Size

381KB
MD5

bba1a4cc39235bf1a7579bace4fb48b9
SHA1

01e6280588ae925749786457c0dbb611e7b17d0a
SHA256

44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e
SHA512

b62a89a562472fa89ee8abf91df84c623572f785742c4df3efdd1e01ec6fb5110fdf24f0afdd93bbfa36ee52a485a6fbf57ba8106ee8b2d736446affe0e0adca
SSDEEP

6144:uMreaHHzY+01nM96uAnjT8xepx1P2DCL:jzHHzY+gGdeHl

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4492	3840	WerFault.exe	82
4256	3840	WerFault.exe	82
3116	3840	WerFault.exe	82
4212	3840	WerFault.exe	82
2004	3840	WerFault.exe	82
2292	3840	WerFault.exe	82
3064	3840	WerFault.exe	82
1696	3840	WerFault.exe	82
688	3840	WerFault.exe	82

Kills process with taskkill 1 IoCs

evasion

pid	Process
2312	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 860	3840	44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe	107
PID 3840 wrote to memory of 860	3840	44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe	107
PID 3840 wrote to memory of 860	3840	44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe	107
PID 860 wrote to memory of 2312	860	cmd.exe	111
PID 860 wrote to memory of 2312	860	cmd.exe	111
PID 860 wrote to memory of 2312	860	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe
"C:\Users\Admin\AppData\Local\Temp\44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 740
  2⤵
  - Program crash
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 784
  2⤵
  - Program crash
  PID:4256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 784
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 868
  2⤵
  - Program crash
  PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 904
  2⤵
  - Program crash
  PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 908
  2⤵
  - Program crash
  PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1008
  2⤵
  - Program crash
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1340
  2⤵
  - Program crash
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "44d30d6e283b9245d82a8e018ac8d12da5675db52fb536cb868f65808908e22e.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1328
  2⤵
  - Program crash
  PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3840 -ip 3840
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3840 -ip 3840
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3840 -ip 3840
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3840 -ip 3840
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3840 -ip 3840
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3840 -ip 3840
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3840 -ip 3840
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3840 -ip 3840
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3840 -ip 3840
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-1-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/3840-2-0x00000000021B0000-0x00000000021DD000-memory.dmp

Filesize
180KB

Download
memory/3840-3-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3840-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3840-7-0x00000000021B0000-0x00000000021DD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing