gcleaner | 19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 08:05

Target
19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe
Size 1.6MB
Sample240707-jy3feaxdpr
SHA256 19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b
MD5 212d967ed570fa020ea37ea56ca07ab0
SHA1 86d951be1166620a1300bcc6bae93c1b955113be
SHA512 c66a4234499f7c2ba334daa449a37e06714896ff4effc587bdec6bdd6cfc08223140010e126f30c28bc9f3185660e965b93a6973e233c4b1aac925978826c6a4
SSDEEP 24576:XYuyF0jY+ScvloS8d8kJt6EK2tbI6k52vqLR+JogynkKXJ:YUTdmTG2CLeyF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Family

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Executes dropped EXE 1 IoCs

pid	Process
2820	KTScw.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4680	19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2820	4680	19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe	86
PID 4680 wrote to memory of 2820	4680	19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe	86
PID 4680 wrote to memory of 2820	4680	19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe	86

C:\Users\Admin\AppData\Local\Temp\19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe
"C:\Users\Admin\AppData\Local\Temp\19444c2a8c5936f16ca0c2823faa9b91e8538678aa4a2003fe49c6d03e12046b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Roaming\{a6cbe9eb-3a65-11ef-9bc3-806e6f6e6963}\KTScw.exe
  2⤵
  - Executes dropped EXE
  PID:2820

KTScw.exe

Path C:\Users\Admin\AppData\Roaming\{a6cbe9eb-3a65-11ef-9bc3-806e6f6e6963}\KTScw.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4680-0-0x0000000000400000-0x00000000013A5000-memory.dmp

Download

memory/4680-1-0x0000000000400000-0x00000000013A5000-memory.dmp

Download

memory/4680-2-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4680-7-0x0000000000400000-0x00000000013A5000-memory.dmp

Download

memory/4680-10-0x0000000000400000-0x0000000000456000-memory.dmp

Download