gcleaner | fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
16-06-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
Size

377KB
MD5

6e4cde98b93c0226f48b4af5c28c69b3
SHA1

84539053e18bbba9fa744bdec66a608df77bb545
SHA256

fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c
SHA512

8cbe25324082ccea3b36140d940b92ce6f0291726fdc8762020b48b4e77d7a53ccc71e1c63fdcf534e0e3cd2e4b444b77da0812bbaab9d9880dc540d4eb27bff
SSDEEP

6144:nFR3hae6Ax+No4g4mV/W9zBUysUg4Me/CKTcbmqrxuDIOubT2:FKe6AH4zMkzBUyseCFmqr8D/8

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2772	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
4364	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
400	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
2484	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
2424	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
4540	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
3572	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
3316	3136	WerFault.exe	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe

pid process

3136 fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe

pid	process
3136	fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe

C:\Users\Admin\AppData\Local\Temp\fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe
"C:\Users\Admin\AppData\Local\Temp\fba5f261b2d096ac50c3241a8a5fa08af6fc784abf3e155baa69f8db15f4849c.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 480
2⤵
- Program crash
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 796
2⤵
- Program crash
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 836
2⤵
- Program crash
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 796
2⤵
- Program crash
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 868
2⤵
- Program crash
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1000
2⤵
- Program crash
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1084
2⤵
- Program crash
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 800
2⤵
- Program crash
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3136 -ip 3136
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3136 -ip 3136
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3136 -ip 3136
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3136 -ip 3136
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3136 -ip 3136
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3136 -ip 3136
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136
1⤵
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3136-2-0x00000000021A0000-0x00000000021DC000-memory.dmp

Filesize
240KB

Download
memory/3136-1-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/3136-4-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3136-6-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/3136-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download