Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 10:24

General

  • Target

    a65ffeb8826e3acc5b8ee765897314b85dd599767d0eee6521caa58071a52a3f.exe

  • Size

    351KB

  • MD5

    763fcbe3425a2abfb6ee647122e74c72

  • SHA1

    72a7ef3e5d89bc2ceb9ec2a89b2a8b1c9dd4226e

  • SHA256

    a65ffeb8826e3acc5b8ee765897314b85dd599767d0eee6521caa58071a52a3f

  • SHA512

    cd969661c4d6edcf4053253614c6571936071fe0c606e5c42734caa199628a3241ac86e1308a80dbd83101e39129f2a793ca32775fa315ad70e65fd2009092a5

  • SSDEEP

    6144:0Fb0nnixOAznhuYjahPmMBLbM9X32IOujTB:0anixOenR+hPPBcx2/s

Score
10/10

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

185.172.128.69

Attributes
  • url_path

    /advdlc.php

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a65ffeb8826e3acc5b8ee765897314b85dd599767d0eee6521caa58071a52a3f.exe
    "C:\Users\Admin\AppData\Local\Temp\a65ffeb8826e3acc5b8ee765897314b85dd599767d0eee6521caa58071a52a3f.exe"
    1⤵
      PID:3056

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3056-1-0x00000000008B0000-0x00000000009B0000-memory.dmp

      Filesize

      1024KB

    • memory/3056-2-0x0000000000230000-0x000000000025D000-memory.dmp

      Filesize

      180KB

    • memory/3056-3-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3056-4-0x0000000000400000-0x0000000000467000-memory.dmp

      Filesize

      412KB

    • memory/3056-6-0x00000000008B0000-0x00000000009B0000-memory.dmp

      Filesize

      1024KB

    • memory/3056-7-0x0000000000230000-0x000000000025D000-memory.dmp

      Filesize

      180KB

    • memory/3056-9-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB