gcleaner | 722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
16-06-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
Size

397KB
MD5

069c91aae80b0039be0711657c507e4b
SHA1

2ec41aa6025dd381ff394739a97d91bdc87de3e5
SHA256

722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535
SHA512

d0f7c45c681929c0c282c03bb3807a167f758f9a5d164335b08b69109eb941c986e8e32d210b821d285dba85d6a6151ca461b1c4a71711cf1312ffe84a4e4af1
SSDEEP

6144:fjWL0aERFXqk8F2SgzUlhNtwbS+EuWCE31YLldJ2fve4KHeCVwy57AUV:fiNEzqk8CYlhNgS+EHCE3cGveUm7

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1484	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
400	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
3812	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
4452	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
1100	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
4824	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
836	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
3464	2464	WerFault.exe	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe

pid process

2464 722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe

pid	process
2464	722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe

C:\Users\Admin\AppData\Local\Temp\722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe
"C:\Users\Admin\AppData\Local\Temp\722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 476
2⤵
- Program crash
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 796
2⤵
- Program crash
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 796
2⤵
- Program crash
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 828
2⤵
- Program crash
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 868
2⤵
- Program crash
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1000
2⤵
- Program crash
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1084
2⤵
- Program crash
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 800
2⤵
- Program crash
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2464 -ip 2464
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2464 -ip 2464
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2464 -ip 2464
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2464 -ip 2464
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2464 -ip 2464
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2464 -ip 2464
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2464 -ip 2464
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2464 -ip 2464
1⤵
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2464-2-0x0000000004090000-0x00000000040CC000-memory.dmp

Filesize
240KB

Download
memory/2464-1-0x00000000024E0000-0x00000000025E0000-memory.dmp

Filesize
1024KB

Download
memory/2464-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/2464-5-0x0000000004090000-0x00000000040CC000-memory.dmp

Filesize
240KB

Download
memory/2464-7-0x00000000024E0000-0x00000000025E0000-memory.dmp

Filesize
1024KB

Download
memory/2464-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download