gcleaner | 24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1

General

Target
24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe
Size 280KB
Sample240709-24vxma1fqm
SHA256 24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1
MD5 1de92ef91b7a10d0b93c286411bcdb64
SHA1 e6163c15b653bb3a247d4bf9e7157485f1ff6323
SHA512 44cc8d2846122ce183b4dbf790887633441c0e50d7daa99c0c6c8fba4f7f78905873e0998cf60fd2d97513482f9335f17951fa4ca5307c1ffd089cd69679bd92
SSDEEP 6144:hGCiQ4meEt2sSiydL9l2m2OmKEwN0W1MNnGUJp8NM:hGDQ1Sicl/FEwN0W1MNGUd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90
77.105.160.30
185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3436	3708	WerFault.exe	77
1340	3708	WerFault.exe	77
6128	3708	WerFault.exe	77
4824	3708	WerFault.exe	77
1436	3708	WerFault.exe	77
5052	3708	WerFault.exe	77
2284	3708	WerFault.exe	77
2756	3708	WerFault.exe	77
2796	3708	WerFault.exe	77
4188	3708	WerFault.exe	77

Kills process with taskkill 1 IoCs

evasion

pid	Process
5076	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2304	3708	24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe	97
PID 3708 wrote to memory of 2304	3708	24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe	97
PID 3708 wrote to memory of 2304	3708	24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe	97
PID 2304 wrote to memory of 5076	2304	cmd.exe	100
PID 2304 wrote to memory of 5076	2304	cmd.exe	100
PID 2304 wrote to memory of 5076	2304	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe
"C:\Users\Admin\AppData\Local\Temp\24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 480
  2⤵
  - Program crash
  PID:3436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 504
  2⤵
  - Program crash
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 792
  2⤵
  - Program crash
  PID:6128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 820
  2⤵
  - Program crash
  PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 836
  2⤵
  - Program crash
  PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 856
  2⤵
  - Program crash
  PID:5052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 960
  2⤵
  - Program crash
  PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 968
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1448
  2⤵
  - Program crash
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "24e2e8f356158366a206f59e08f5a89b70d3f25471ac84daf962d0c5736409f1.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1408
  2⤵
  - Program crash
  PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3708 -ip 3708
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3708 -ip 3708
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3708 -ip 3708
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3708 -ip 3708
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3708 -ip 3708
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3708 -ip 3708
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3708 -ip 3708
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3708 -ip 3708
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3708 -ip 3708
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3708 -ip 3708
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3708-1-0x0000000002920000-0x0000000002A20000-memory.dmp

Download

memory/3708-2-0x0000000004670000-0x00000000046AC000-memory.dmp

Download

memory/3708-3-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3708-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3708-6-0x0000000004670000-0x00000000046AC000-memory.dmp

Download

memory/3708-5-0x0000000000400000-0x000000000282D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads