gcleaner | fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5

Analysis

max time kernel
9s
max time network
91s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5881584c73a9416a65cbc5ca849f5bb_JaffaCakes118.exe
Size

406KB
MD5

f5881584c73a9416a65cbc5ca849f5bb
SHA1

e50f322a92332202299fbd9b38e0ccd793058133
SHA256

fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5
SHA512

4e608be3de18065f89ae0144ccb46378a26cf15e61f739a338bf5f544b1060a8c800549256d17bb741c140dd68b0fc0c8bbc1c392b4824524dbfb7409bc2b168
SSDEEP

6144:/w93IXt3CxKqTlV+eAX25kXliWRi2HCZ0wVAqfMcbFqf55oV7RHoL:xXtyZieAX2ElJRi1ax5M

Score

10^/10

gcleaner onlylogger discovery loader

Malware Config

Extracted

Family

gcleaner

ggc-partners.in

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

resource	yara_rule
behavioral1/memory/2392-2-0x00000000001B0000-0x00000000001DE000-memory.dmp	family_onlylogger
behavioral1/memory/2392-3-0x0000000000400000-0x0000000003302000-memory.dmp	family_onlylogger
behavioral1/memory/2392-4-0x0000000000400000-0x0000000003302000-memory.dmp	family_onlylogger
behavioral1/memory/2392-5-0x00000000001B0000-0x00000000001DE000-memory.dmp	family_onlylogger

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

C:\Users\Admin\AppData\Local\Temp\f5881584c73a9416a65cbc5ca849f5bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5881584c73a9416a65cbc5ca849f5bb_JaffaCakes118.exe"
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-2-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/2392-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2392-3-0x0000000000400000-0x0000000003302000-memory.dmp

Filesize
47.0MB

Download
memory/2392-4-0x0000000000400000-0x0000000003302000-memory.dmp

Filesize
47.0MB

Download
memory/2392-5-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/2392-7-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download