gcleaner | 97d90e1a63c0243f8877d6c3d5dab717f0763154c3b7943e0287c351ff9a45a2

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
Size

334KB
MD5

60194970d3fca26d6d62ad4263a3ad62
SHA1

561eddc46818941773b0ec6fd1694da5031eb467
SHA256

99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1
SHA512

b7982f2f128e381cefffc9aef07c8974e303789988f11d71d4a329e20fbfcca958ffc3c1eccaf68f7f8ba720fae3ad6d900cddb597bf42a5718ffeea8e501f09
SSDEEP

6144:xTgQjN1N+dwK8kYud6mHFAJQXZYG0FjPbb52qX7tNfVXVHQLIiu8cfo0/pW:2QjNr0wK9FyJkYpjR2wZGEX8cA0/M

Score

10^/10

gcleaner onlylogger loader

Malware Config

Extracted

Family

gcleaner

ppp-gl.biz

45.9.20.13

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/760-2-0x0000000004B30000-0x0000000004B5F000-memory.dmp	family_onlylogger
behavioral2/memory/760-3-0x0000000000400000-0x0000000002F1D000-memory.dmp	family_onlylogger
behavioral2/memory/760-7-0x0000000004B30000-0x0000000004B5F000-memory.dmp	family_onlylogger
behavioral2/memory/760-9-0x0000000000400000-0x0000000002F1D000-memory.dmp	family_onlylogger

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3036	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
2456	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
892	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
4680	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
2528	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
2804	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
2064	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
3544	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
4344	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
4288	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
2324	760	WerFault.exe	99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe

C:\Users\Admin\AppData\Local\Temp\99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe
"C:\Users\Admin\AppData\Local\Temp\99427242576075c6bfc1038c07587b07f69b0d85149fbf0091b9a582e68a9cf1.exe"
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 468
2⤵
- Program crash
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 648
2⤵
- Program crash
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 672
2⤵
- Program crash
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 828
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 956
2⤵
- Program crash
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 964
2⤵
- Program crash
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 844
2⤵
- Program crash
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1060
2⤵
- Program crash
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1208
2⤵
- Program crash
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1252
2⤵
- Program crash
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 832
2⤵
- Program crash
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 760 -ip 760
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 760 -ip 760
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 760 -ip 760
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 760 -ip 760
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 760 -ip 760
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 760 -ip 760
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 760 -ip 760
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 760 -ip 760
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 760 -ip 760
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 760 -ip 760
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 760 -ip 760
1⤵
PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-1-0x0000000003090000-0x0000000003190000-memory.dmp

Filesize
1024KB

Download
memory/760-2-0x0000000004B30000-0x0000000004B5F000-memory.dmp

Filesize
188KB

Download
memory/760-3-0x0000000000400000-0x0000000002F1D000-memory.dmp

Filesize
43.1MB

Download
memory/760-5-0x0000000003090000-0x0000000003190000-memory.dmp

Filesize
1024KB

Download
memory/760-7-0x0000000004B30000-0x0000000004B5F000-memory.dmp

Filesize
188KB

Download
memory/760-9-0x0000000000400000-0x0000000002F1D000-memory.dmp

Filesize
43.1MB

Download