gcleaner | 5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
22-06-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
Size

332KB
MD5

7d16b7eff68e7fd20cba045ff4e89abc
SHA1

b4d88e31624138c58fbb5d197d17dd65dccfbc99
SHA256

5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4
SHA512

af52253a7430807e9cfed310c28e36b79c4155edda6f058f0990cfb41ae9b4e727e96ca3059058853099419944e51dda3223f5874cd714b24591de6fea0c35e5
SSDEEP

6144:pFAk8nQ2fAlR3PHzaAyDJ5Tlo5yLk2r+iJgPoKVKF23M:pFAk8RfAre4Yii6R3

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1484	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
2140	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
5056	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
4220	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
4356	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
408	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
4724	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
3308	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
4700	3036	WerFault.exe	5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe

C:\Users\Admin\AppData\Local\Temp\5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe
"C:\Users\Admin\AppData\Local\Temp\5b7b3823baca5ac6613f75a32dff792fbcc2dfaf2c128ebc338993f868ba4df4.exe"
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 480
2⤵
- Program crash
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 472
2⤵
- Program crash
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 780
2⤵
- Program crash
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 800
2⤵
- Program crash
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 780
2⤵
- Program crash
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 852
2⤵
- Program crash
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 976
2⤵
- Program crash
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1068
2⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 784
2⤵
- Program crash
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
1⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3036 -ip 3036
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3036 -ip 3036
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3036 -ip 3036
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3036 -ip 3036
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3036 -ip 3036
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3036 -ip 3036
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3036 -ip 3036
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
1⤵
PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/3036-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3036-2-0x0000000002160000-0x000000000219C000-memory.dmp

Filesize
240KB

Download
memory/3036-4-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3036-6-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/3036-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download