gcleaner | a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6

General

Target

a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
Size

255KB
MD5

3c3969cc64c9f17a2fc232bb6adc22f2
SHA1

4a63e6ef037fd3e5ffcc97609258c72ebad88ab0
SHA256

a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6
SHA512

d573d247c8e6cc287691d7f6c1141b2074aa39fdcbc07f6c4a684307ecc136901b73bcbd0bf9b6e6c418af732bdd1794794253d9d5957f52d67409cb9a9b35a6
SSDEEP

3072:0S9kujIn3OfhxFb+EmBFV8z9AXlJSkIrjw3vNldU11bAS1UyGYNlThZAZ40Ud8:0vktiZpO1Pw3bsZAyUnylThZAZ40

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4316	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
4204	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
1028	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
4896	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
2196	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
5000	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
796	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
1576	1624	WerFault.exe	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3120 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3120 taskkill.exe

pid	process
3120	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3120	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.execmd.exe

description	pid	process	target process
PID 1624 wrote to memory of 924	1624	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe	cmd.exe
PID 1624 wrote to memory of 924	1624	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe	cmd.exe
PID 1624 wrote to memory of 924	1624	a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe	cmd.exe
PID 924 wrote to memory of 3120	924	cmd.exe	taskkill.exe
PID 924 wrote to memory of 3120	924	cmd.exe	taskkill.exe
PID 924 wrote to memory of 3120	924	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe
"C:\Users\Admin\AppData\Local\Temp\a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 772
2⤵
- Program crash
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 792
2⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 772
2⤵
- Program crash
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 844
2⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 976
2⤵
- Program crash
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 980
2⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1424
2⤵
- Program crash
PID:796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "a8e670addc2416e691f259146e2eca4e8448911e93f438ac4b23c9b6d46169f6.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1452
2⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1624 -ip 1624
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1624 -ip 1624
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1624 -ip 1624
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1624 -ip 1624
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1624 -ip 1624
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1624 -ip 1624
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1624 -ip 1624
1⤵
PID:4048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-1-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/1624-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-2-0x00000000021D0000-0x00000000021FD000-memory.dmp

Filesize
180KB

Download
memory/1624-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-5-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download

Analysis

Sharing