gcleaner | d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20-06-2024 21:18

Target

d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
Size

399KB
MD5

3b8e8465c4d83abf59440cc038332808
SHA1

7471a99122d9a91fb6286bd34dfa35ff446893e2
SHA256

d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4
SHA512

12e4dda6d7f687b44280b0cbe4a433378cb4318203e27d37048fe48d658a725f52f55830eb0373a43bbc11b8553b383cb48ef71ff3c6b949f36bfea917451339
SSDEEP

6144:pKKLS8epklmhmEN9gVjJXwZfr7iTPhXiaLa6DLDO1KQ1KQ:AKmfpklmgEN9eNwJviTpXi+a6D

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2088	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
1136	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
2496	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
2368	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
4960	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
1916	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
832	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
544	3000	WerFault.exe	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe

pid process

3000 d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe

pid	process
3000	d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe

C:\Users\Admin\AppData\Local\Temp\d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe
"C:\Users\Admin\AppData\Local\Temp\d93682cf14722d3d0885f8d684785c543a3e4a9e40e512d5ae4cad8bb3176ba4.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 476
  2⤵
  - Program crash
  PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 796
  2⤵
  - Program crash
  PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 804
  2⤵
  - Program crash
  PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 852
  2⤵
  - Program crash
  PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 828
  2⤵
  - Program crash
  PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1000
  2⤵
  - Program crash
  PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1008
  2⤵
  - Program crash
  PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1332
  2⤵
  - Program crash
  PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3000 -ip 3000
1⤵
PID:248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3000 -ip 3000
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3000 -ip 3000
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3000 -ip 3000
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3000 -ip 3000
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3000 -ip 3000
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3000 -ip 3000
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3000 -ip 3000
1⤵
PID:3988

memory/3000-2-0x0000000004480000-0x00000000044BC000-memory.dmp

Filesize
240KB

Download
memory/3000-1-0x0000000002AA0000-0x0000000002BA0000-memory.dmp

Filesize
1024KB

Download
memory/3000-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3000-4-0x0000000000400000-0x0000000002750000-memory.dmp

Filesize
35.3MB

Download
memory/3000-5-0x0000000002AA0000-0x0000000002BA0000-memory.dmp

Filesize
1024KB

Download
memory/3000-7-0x0000000004480000-0x00000000044BC000-memory.dmp

Filesize
240KB

Download
memory/3000-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download