gcleaner | 732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
Size

400KB
MD5

b21ae81100683d3df3810d95fda18492
SHA1

e257a975d90fb53fe101c48e8afea110df7e2acf
SHA256

732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79
SHA512

894c56715d124de5dba9470a2ce8ae0a8fef7930f9dfcf7903e0c2f2a4fb9f63bc6e0976a179b1d8176de754366ddce1efeb2ef9833f077cfeda16c91865034e
SSDEEP

6144:xGLPBqwJ5TpzTT6LSfcm6a89Fi8OSndl3eLpeIe+Kpgfb:47BqW5TpzaLS09OSdY3H

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4552	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
3468	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
628	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
1020	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
3164	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
4652	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
5096	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
512	796	WerFault.exe	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe

pid process

796 732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe

pid	process
796	732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe

C:\Users\Admin\AppData\Local\Temp\732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe
"C:\Users\Admin\AppData\Local\Temp\732b56be62d4a6b93fbdbde4de81e5a0e498fc567ed5799baf812a432e771c79.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 456
2⤵
- Program crash
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 764
2⤵
- Program crash
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 804
2⤵
- Program crash
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 764
2⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 836
2⤵
- Program crash
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 928
2⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 932
2⤵
- Program crash
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 768
2⤵
- Program crash
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 796 -ip 796
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 796 -ip 796
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 796 -ip 796
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 796 -ip 796
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 796 -ip 796
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 796 -ip 796
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 796 -ip 796
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 796 -ip 796
1⤵
PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-1-0x0000000002620000-0x0000000002720000-memory.dmp

Filesize
1024KB

Download
memory/796-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/796-2-0x0000000003FC0000-0x0000000003FFC000-memory.dmp

Filesize
240KB

Download
memory/796-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/796-5-0x0000000002620000-0x0000000002720000-memory.dmp

Filesize
1024KB

Download
memory/796-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download