gcleaner | 8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8

General

Target

8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
Size

269KB
MD5

1d02dbc7a19497a739f8db843b42bd15
SHA1

1376cf6fc76aaed204dd9abb4f85b3e43c093bef
SHA256

8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8
SHA512

5da4137095a72d6557952591840debe07e84579101132d3e2affb4fb7defb71142603ae27995e22b449413fa5a5019e4f3dcfa998caded0b37aa3a28a03f8654
SSDEEP

3072:2lV142hxL8V3SuBboz7sPkhAbrHOGx0Xzmk/ujR8VE9blkWx8GiW5tsEX:2lQ2rSM7iGAbinvuN0E9gL

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe

description	pid	process	target process
PID 2864 set thread context of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4552 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4552 taskkill.exe

pid	process
4552	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4552	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.execmd.exe

C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
"C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864

C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
"C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-1-0x0000000002660000-0x0000000002760000-memory.dmp

Filesize
1024KB

Download
memory/2864-2-0x00000000025D0000-0x000000000260D000-memory.dmp

Filesize
244KB

Download
memory/4852-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

description	pid	process	target process
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 2864 wrote to memory of 4852	2864	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe
PID 4852 wrote to memory of 3740	4852	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	cmd.exe
PID 4852 wrote to memory of 3740	4852	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	cmd.exe
PID 4852 wrote to memory of 3740	4852	8bff409b5f2000f575688a87638b98d592c134b5846761357457a93680de35f8.exe	cmd.exe
PID 3740 wrote to memory of 4552	3740	cmd.exe	taskkill.exe
PID 3740 wrote to memory of 4552	3740	cmd.exe	taskkill.exe
PID 3740 wrote to memory of 4552	3740	cmd.exe	taskkill.exe

Analysis

Sharing