gcleaner | 158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
Size

310KB
MD5

1fdf30813fe7eaefaf11478e75602bd9
SHA1

62b217617634ee65c27f830d47971ae4de9e6028
SHA256

158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9
SHA512

63335fe55535ca02a25bfee8f084f7bc26437d71f7e934e0d6a440383b96f319873b29065e6fa7a7814ca490c6c21c63e53bb1302c483487638d259cdfd23bc5
SSDEEP

3072:YflUwFVGVfSSDQ42UyTQ+jOqqhU0DtJRhkwStkOvXeCBmrjxfTwc3wR66IHwvy0Q:5wFVia3BTxjOqqhp7RnCBmhfT2cs/

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3232	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
4268	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
4260	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
4720	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
2164	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
4932	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
5004	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
904	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
3748	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
2972	2276	WerFault.exe	158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe

C:\Users\Admin\AppData\Local\Temp\158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe
"C:\Users\Admin\AppData\Local\Temp\158f896ff1179e557f1a4987eae4527e86f7c7deb2c021d48fd6cd17d75c41c9.exe"
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 452
2⤵
- Program crash
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 512
2⤵
- Program crash
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 748
2⤵
- Program crash
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 768
2⤵
- Program crash
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 768
2⤵
- Program crash
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 840
2⤵
- Program crash
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 912
2⤵
- Program crash
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 916
2⤵
- Program crash
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1076
2⤵
- Program crash
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 752
2⤵
- Program crash
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2276 -ip 2276
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2276 -ip 2276
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2276 -ip 2276
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2276 -ip 2276
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2276 -ip 2276
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2276 -ip 2276
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2276 -ip 2276
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2276 -ip 2276
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-2-0x00000000020B0000-0x00000000020EC000-memory.dmp

Filesize
240KB

Download
memory/2276-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-1-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/2276-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2276-6-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/2276-7-0x00000000020B0000-0x00000000020EC000-memory.dmp

Filesize
240KB

Download
memory/2276-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download