gcleaner | e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
10-06-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
Size

364KB
MD5

86d023325ff7425722dc4c2293258ee5
SHA1

3a71c5124ad649d1a2707f4796d79e1caccb07e9
SHA256

e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3
SHA512

02e1bfa5ee4b7e4f2d0afec591f68662d02481ba4bd3aa25b789f0f007538b635aaaec008916cf07c7f2bc7f5c2bf115b5be79a25cd239fff603638c3c3046c3
SSDEEP

6144:20aHM2Rj+AyGfM/XO7P3sy/+BRpzDeTfFb4T:20aHLaAyG0/XO7P3N/+BbzDeT6

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
896	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
4496	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
1956	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
692	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
1900	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
3456	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
648	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
2068	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
2256	3164	WerFault.exe	e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe

C:\Users\Admin\AppData\Local\Temp\e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe
"C:\Users\Admin\AppData\Local\Temp\e2070c7e677cfed329969d82463e584e4bca17c61ed634fec3a8c9b92e4a20b3.exe"
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 476
2⤵
- Program crash
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 488
2⤵
- Program crash
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 780
2⤵
- Program crash
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 820
2⤵
- Program crash
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 780
2⤵
- Program crash
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 872
2⤵
- Program crash
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 984
2⤵
- Program crash
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1072
2⤵
- Program crash
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 784
2⤵
- Program crash
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3164 -ip 3164
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3164 -ip 3164
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3164 -ip 3164
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3164 -ip 3164
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3164 -ip 3164
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3164 -ip 3164
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3164 -ip 3164
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-1-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/3164-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3164-2-0x0000000000A00000-0x0000000000A3C000-memory.dmp

Filesize
240KB

Download
memory/3164-4-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/3164-5-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/3164-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download