gcleaner | 6289e3d6eb341c4137087cfbbf250f6641d5a1f94d5debe90eb4328bd88cd7b6

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6289e3d6eb341c4137087cfbbf250f6641d5a1f94d5debe90eb4328bd88cd7b6.exe
Size 365KB
Sample240625-l5ec9stbka
SHA256 6289e3d6eb341c4137087cfbbf250f6641d5a1f94d5debe90eb4328bd88cd7b6
MD5 da778e5b2537bcbb372bd5a355f0fa27
SHA1 81f3abd7fbb0e6b0bfa57f4531b81516b85d0539
SHA512 483124d029138aaf608fc46e10a8f58fd27c9ce01e6acb09ca226bd7272bec9111be0731d36500772d8f599c83533b97480bec4cd2ccd45764212b76168c10ac
SSDEEP 6144:VzGdoLehBhvg+vBuj7Ci49R04Y19Mkz1Y7izi:VqdoChB1iCdY1Pu7i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90
185.172.128.69

Attributes

url_path
/advdlc.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4684	3704	WerFault.exe	80
2680	3704	WerFault.exe	80
3976	3704	WerFault.exe	80
1204	3704	WerFault.exe	80
1520	3704	WerFault.exe	80
4048	3704	WerFault.exe	80
1124	3704	WerFault.exe	80
3532	3704	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\6289e3d6eb341c4137087cfbbf250f6641d5a1f94d5debe90eb4328bd88cd7b6.exe
"C:\Users\Admin\AppData\Local\Temp\6289e3d6eb341c4137087cfbbf250f6641d5a1f94d5debe90eb4328bd88cd7b6.exe"
1⤵
PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 740
  2⤵
  - Program crash
  PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 760
  2⤵
  - Program crash
  PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 740
  2⤵
  - Program crash
  PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 760
  2⤵
  - Program crash
  PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 904
  2⤵
  - Program crash
  PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 980
  2⤵
  - Program crash
  PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 1112
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 744
  2⤵
  - Program crash
  PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704
1⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3704 -ip 3704
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3704 -ip 3704
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3704 -ip 3704
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3704 -ip 3704
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3704 -ip 3704
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3704 -ip 3704
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3704 -ip 3704
1⤵
PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-1-0x00000000027C0000-0x00000000028C0000-memory.dmp

Download

memory/3704-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3704-2-0x00000000028D0000-0x00000000028FD000-memory.dmp

Download

memory/3704-4-0x0000000000400000-0x0000000002748000-memory.dmp

Download

memory/3704-6-0x00000000027C0000-0x00000000028C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads