gcleaner | adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
Size

392KB
MD5

a8d14c2aee72601b0187a8b03a2c5a70
SHA1

44ba442c8235953d224a8b4e95aef84d190d83c1
SHA256

adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0
SHA512

3e6b6779544c41f260f7f281960e58dd992b3c2294d868ca2620c0078a3a78e0e3e04d26b77116aae92bffa68c0d352fcd3a8fac838e558aaf8f6649adfb78b1
SSDEEP

6144:BYavswvPY5L/Lwe0/laYz5bVu9tkpr+Zls54Mh19lzDeTfFb4T:PswvPuxkMqVu3le5Z1zDeT6

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4224	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
2316	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
684	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
1112	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
3688	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
4480	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
2404	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
3596	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
5044	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
3328	3632	WerFault.exe	adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe

C:\Users\Admin\AppData\Local\Temp\adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe
"C:\Users\Admin\AppData\Local\Temp\adb64db04eef2da9ab7a4d866383f31564eaaa95206aa2a5e9b28ff8218750a0.exe"
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 452
2⤵
- Program crash
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 480
2⤵
- Program crash
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 748
2⤵
- Program crash
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 768
2⤵
- Program crash
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 768
2⤵
- Program crash
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 792
2⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 912
2⤵
- Program crash
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 920
2⤵
- Program crash
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1032
2⤵
- Program crash
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 752
2⤵
- Program crash
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 3632
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3632 -ip 3632
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3632 -ip 3632
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3632 -ip 3632
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3632 -ip 3632
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3632 -ip 3632
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3632 -ip 3632
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3632 -ip 3632
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3632 -ip 3632
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 3632
1⤵
PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-1-0x0000000000970000-0x0000000000A70000-memory.dmp

Filesize
1024KB

Download
memory/3632-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-2-0x0000000000910000-0x000000000094C000-memory.dmp

Filesize
240KB

Download
memory/3632-4-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/3632-5-0x0000000000970000-0x0000000000A70000-memory.dmp

Filesize
1024KB

Download
memory/3632-6-0x0000000000910000-0x000000000094C000-memory.dmp

Filesize
240KB

Download
memory/3632-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download