gcleaner | ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 08:24

Target

ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
Size

383KB
MD5

d94fa42cdcc2a9eae3b70a7350b169f9
SHA1

6d61e4bab0e98948ee98d0a6ef27ca6109d671f4
SHA256

ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e
SHA512

d45776fd7295b63af8deb3c5e53132ccb9a5bd054f88aaaeb919c626064c117a0bc92cec2ae19b4f3dc7d1f0323b2290d11a8b8a982319b947a020fc600112c7
SSDEEP

6144:GvaISkrkbFQuI4UI8Px2Cr7ob8Rk4QcQTXjIOubTh:EhZwbl6UCPMgk4QcQXj/8

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4496	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
4932	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
2072	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
5000	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
3648	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
1012	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
2656	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
1944	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
3456	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
1232	884	WerFault.exe	ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe

C:\Users\Admin\AppData\Local\Temp\ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe
"C:\Users\Admin\AppData\Local\Temp\ac2ca8f0f447c0321caced59c99dc4076d957ce86c35ccc516ad0212f9b3fb4e.exe"
1⤵
PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 460
  2⤵
  - Program crash
  PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 464
  2⤵
  - Program crash
  PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 748
  2⤵
  - Program crash
  PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 784
  2⤵
  - Program crash
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 776
  2⤵
  - Program crash
  PID:3648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 840
  2⤵
  - Program crash
  PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 912
  2⤵
  - Program crash
  PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1004
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1072
  2⤵
  - Program crash
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 756
  2⤵
  - Program crash
  PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 884 -ip 884
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 884 -ip 884
1⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 884 -ip 884
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 884 -ip 884
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 884 -ip 884
1⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 884 -ip 884
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 884 -ip 884
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 884 -ip 884
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 884 -ip 884
1⤵
PID:548

memory/884-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/884-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/884-2-0x0000000000530000-0x000000000056C000-memory.dmp

Filesize
240KB

Download
memory/884-4-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/884-6-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/884-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download