gcleaner | c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
14-06-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
Size

364KB
MD5

0e47d33731488688c76ab57e1f0ed0b3
SHA1

9819bcf9d33e937fb69ec3aa1bf5523718079e27
SHA256

c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185
SHA512

e400f8f5de8955ea20d35560ffecb99edd3156b7e162bddca87d4dbbe8632f2914beae69c29d0b74e904ccab3099f202af27a8e00175f76e4e85c5ec43ac290e
SSDEEP

6144:alCVH7TRNfSLhNhHDN14sRE+4Fo8n0IGnUCSdTp:BHchNH14ME+n80N8p

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2628	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
4128	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
3344	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
2500	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
2380	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
2176	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
4952	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
3860	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
3764	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
1392	2464	WerFault.exe	c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe

C:\Users\Admin\AppData\Local\Temp\c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe
"C:\Users\Admin\AppData\Local\Temp\c8e15a3d32859ac0ea0a6d71da8c79f40995a603390996bea2e37ab48d0e7185.exe"
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 476
2⤵
- Program crash
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 536
2⤵
- Program crash
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 780
2⤵
- Program crash
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 800
2⤵
- Program crash
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 832
2⤵
- Program crash
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 824
2⤵
- Program crash
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 984
2⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1084
2⤵
- Program crash
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1092
2⤵
- Program crash
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 784
2⤵
- Program crash
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2464 -ip 2464
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2464 -ip 2464
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2464 -ip 2464
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2464 -ip 2464
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2464 -ip 2464
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2464 -ip 2464
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2464 -ip 2464
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2464 -ip 2464
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2464 -ip 2464
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2464 -ip 2464
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-2-0x00000000021A0000-0x00000000021DC000-memory.dmp

Filesize
240KB

Download
memory/2464-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2464-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2464-4-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2464-5-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2464-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download