gcleaner | 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bad4b2e33b5f46cd55e649f44f27e90_NeikiAnalytics.exe
Size 277KB
Sample240603-e53mjacg69
SHA256 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388
MD5 9bad4b2e33b5f46cd55e649f44f27e90
SHA1 6cfe6ef810f28a4e562e9e36e53fe1dec1dde4e3
SHA512 251c75fa82aff8902bf52581164a16cb9b9efaf2902eecca7a5b81b7d8d21560594b6e2c0bc272ef72d4a0b4b1bda069fb463dd1d7eaabd5704fa005d4682c89
SSDEEP 6144:xDh9q1Lk0EIqdME2iDpDNSbIEzHyd3hYPOw:xDh92Lk0t1ZQ0JbYw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90
5.42.64.56
185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3712	4876	WerFault.exe	82
2632	4876	WerFault.exe	82
4436	4876	WerFault.exe	82
4668	4876	WerFault.exe	82
4752	4876	WerFault.exe	82
3100	4876	WerFault.exe	82
4052	4876	WerFault.exe	82
3216	4876	WerFault.exe	82
3532	4876	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\9bad4b2e33b5f46cd55e649f44f27e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9bad4b2e33b5f46cd55e649f44f27e90_NeikiAnalytics.exe"
1⤵
PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 464
  2⤵
  - Program crash
  PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 500
  2⤵
  - Program crash
  PID:2632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 768
  2⤵
  - Program crash
  PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 788
  2⤵
  - Program crash
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 452
  2⤵
  - Program crash
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 840
  2⤵
  - Program crash
  PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 824
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 984
  2⤵
  - Program crash
  PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 448
  2⤵
  - Program crash
  PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4876 -ip 4876
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4876 -ip 4876
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4876 -ip 4876
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4876 -ip 4876
1⤵
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4876 -ip 4876
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4876 -ip 4876
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4876 -ip 4876
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 4876
1⤵
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-1-0x0000000002F30000-0x0000000003030000-memory.dmp

Download

memory/4876-2-0x00000000048D0000-0x000000000490C000-memory.dmp

Download

memory/4876-3-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4876-5-0x0000000000400000-0x0000000002CA4000-memory.dmp

Download

memory/4876-8-0x00000000048D0000-0x000000000490C000-memory.dmp

Download

memory/4876-7-0x0000000002F30000-0x0000000003030000-memory.dmp

Download

memory/4876-9-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads