Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 08:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe

  • Size

    383KB

  • MD5

    d94fa42cdcc2a9eae3b70a7350b169f9

  • SHA1

    6d61e4bab0e98948ee98d0a6ef27ca6109d671f4

  • SHA256

    ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e

  • SHA512

    d45776fd7295b63af8deb3c5e53132ccb9a5bd054f88aaaeb919c626064c117a0bc92cec2ae19b4f3dc7d1f0323b2290d11a8b8a982319b947a020fc600112c7

  • SSDEEP

    6144:GvaISkrkbFQuI4UI8Px2Cr7ob8Rk4QcQTXjIOubTh:EhZwbl6UCPMgk4QcQXj/8

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Program crash 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
    "C:\Users\Admin\AppData\Local\Temp\ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe"
    1⤵
      PID:884
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 460
        2⤵
        • Program crash
        PID:4496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 464
        2⤵
        • Program crash
        PID:4932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 748
        2⤵
        • Program crash
        PID:2072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 784
        2⤵
        • Program crash
        PID:5000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 776
        2⤵
        • Program crash
        PID:3648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 840
        2⤵
        • Program crash
        PID:1012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 912
        2⤵
        • Program crash
        PID:2656
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1004
        2⤵
        • Program crash
        PID:1944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1072
        2⤵
        • Program crash
        PID:3456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 756
        2⤵
        • Program crash
        PID:1232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
      1⤵
        PID:4428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 884 -ip 884
        1⤵
          PID:2248
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 884 -ip 884
          1⤵
            PID:992
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 884 -ip 884
            1⤵
              PID:4732
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 884 -ip 884
              1⤵
                PID:2364
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 884 -ip 884
                1⤵
                  PID:2968
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 884 -ip 884
                  1⤵
                    PID:5084
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 884 -ip 884
                    1⤵
                      PID:4152
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 884 -ip 884
                      1⤵
                        PID:2200
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 884 -ip 884
                        1⤵
                          PID:548

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/884-1-0x00000000005D0000-0x00000000006D0000-memory.dmp
                          Filesize

                          1024KB

                          Download
                        • memory/884-3-0x0000000000400000-0x0000000000440000-memory.dmp
                          Filesize

                          256KB

                          Download
                        • memory/884-2-0x0000000000530000-0x000000000056C000-memory.dmp
                          Filesize

                          240KB

                          Download
                        • memory/884-4-0x0000000000400000-0x0000000000470000-memory.dmp
                          Filesize

                          448KB

                          Download
                        • memory/884-6-0x00000000005D0000-0x00000000006D0000-memory.dmp
                          Filesize

                          1024KB

                          Download
                        • memory/884-7-0x0000000000400000-0x0000000000440000-memory.dmp
                          Filesize

                          256KB

                          Download