gcleaner | 6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d.exe
Size 307KB
Sample240601-x97fdsde43
SHA256 6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d
MD5 747395a7777c19c8b665ec6bb586ff3a
SHA1 13f4e9d3354c4e9d3a681b37d37286e171fdc65b
SHA512 804d1771277c282f7c8f07ef6c41def4bc63ae20e35bbbd338bf3d1e5d8a31e8b62c84a7bcc966cea662858c40609553150557689c9fa84ce0e70b5c92ca30f5
SSDEEP 3072:UjG7OjhVQ/OISTdP8Ztd5rG3eVATxyFPBuflzqhLkgbe+3mILcqJs5rdKGdKth:UEOjcVMR8Ztdlw+PB08zbTWInQK6Kth
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90
5.42.64.56
185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 12 IoCs

pid	pid_target	Process	procid_target
1052	2112	WerFault.exe	90
4352	2112	WerFault.exe	90
1216	2112	WerFault.exe	90
1772	2112	WerFault.exe	90
2848	2112	WerFault.exe	90
4052	2112	WerFault.exe	90
3436	2112	WerFault.exe	90
3536	2112	WerFault.exe	90
4436	2112	WerFault.exe	90
632	2112	WerFault.exe	90
2272	2112	WerFault.exe	90
2776	2112	WerFault.exe	90

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d.exe

C:\Users\Admin\AppData\Local\Temp\6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d.exe
"C:\Users\Admin\AppData\Local\Temp\6a41f4693bf480f6b8957759f250b4ff8cff871b0c36e4b8fb6d00e378e38a4d.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 460
  2⤵
  - Program crash
  PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 776
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 768
  2⤵
  - Program crash
  PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 776
  2⤵
  - Program crash
  PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 840
  2⤵
  - Program crash
  PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 928
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 932
  2⤵
  - Program crash
  PID:3436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1072
  2⤵
  - Program crash
  PID:3536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1028
  2⤵
  - Program crash
  PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1060
  2⤵
  - Program crash
  PID:632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 780
  2⤵
  - Program crash
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1260
  2⤵
  - Program crash
  PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2112 -ip 2112
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2112 -ip 2112
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2112 -ip 2112
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2112 -ip 2112
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
1⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2112 -ip 2112
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2112 -ip 2112
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2112 -ip 2112
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=764 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2112 -ip 2112
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2112 -ip 2112
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2112 -ip 2112
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
1⤵
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-1-0x0000000001EF0000-0x0000000001FF0000-memory.dmp

Download

memory/2112-2-0x0000000001D20000-0x0000000001D5C000-memory.dmp

Download

memory/2112-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2112-3-0x0000000000400000-0x0000000001BC7000-memory.dmp

Download

memory/2112-5-0x0000000000400000-0x0000000001BC7000-memory.dmp

Download

memory/2112-7-0x0000000001EF0000-0x0000000001FF0000-memory.dmp

Download

memory/2112-8-0x0000000001D20000-0x0000000001D5C000-memory.dmp

Download

memory/2112-9-0x0000000000400000-0x0000000001BC7000-memory.dmp

Download

memory/2112-10-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads