gcleaner | 9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b

General

Target
9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe
Size 280KB
Sample240709-3twxlsverh
SHA256 9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b
MD5 fe32ede1c266670343ce460d406e8ded
SHA1 bdb61f8d4f94cc6eb08a4bc59d7f3414db465a6d
SHA512 b0400994aabc9be4ee214eb72ec69a6d8ccb34ddd5361e9edef1b0f32981356b840b458f10440df47c475d5613f1064fde8cb49d0dbd896033007169d768bdf8
SSDEEP 6144:7GCiQ4m+DBA8FL1Goqp5qjfU51FZIMBS9Dg/+kYNUJp8TM:7GDQmNHL1G3pYjw1ZS9kGU7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90
77.105.160.30
185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
696	2376	WerFault.exe	77
4448	2376	WerFault.exe	77
2436	2376	WerFault.exe	77
3272	2376	WerFault.exe	77
4392	2376	WerFault.exe	77
2828	2376	WerFault.exe	77
1532	2376	WerFault.exe	77
2904	2376	WerFault.exe	77
3324	2376	WerFault.exe	77
1108	2376	WerFault.exe	77

Kills process with taskkill 1 IoCs

evasion

pid	Process
4288	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 384	2376	9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe	97
PID 2376 wrote to memory of 384	2376	9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe	97
PID 2376 wrote to memory of 384	2376	9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe	97
PID 384 wrote to memory of 4288	384	cmd.exe	101
PID 384 wrote to memory of 4288	384	cmd.exe	101
PID 384 wrote to memory of 4288	384	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe
"C:\Users\Admin\AppData\Local\Temp\9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 480
  2⤵
  - Program crash
  PID:696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 504
  2⤵
  - Program crash
  PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 784
  2⤵
  - Program crash
  PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 784
  2⤵
  - Program crash
  PID:3272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 816
  2⤵
  - Program crash
  PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 876
  2⤵
  - Program crash
  PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 960
  2⤵
  - Program crash
  PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1072
  2⤵
  - Program crash
  PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1436
  2⤵
  - Program crash
  PID:3324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "9c972b73da3ace0f4c43d9b1f3e16096e6f395dea0bd311b4e59ea263028568b.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1384
  2⤵
  - Program crash
  PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2376 -ip 2376
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2376 -ip 2376
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2376 -ip 2376
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2376 -ip 2376
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2376 -ip 2376
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2376 -ip 2376
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2376 -ip 2376
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2376 -ip 2376
1⤵
PID:132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2376 -ip 2376
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-1-0x0000000002A80000-0x0000000002B80000-memory.dmp

Download

memory/2376-2-0x00000000046E0000-0x000000000471C000-memory.dmp

Download

memory/2376-3-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2376-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2376-6-0x00000000046E0000-0x000000000471C000-memory.dmp

Download

memory/2376-5-0x0000000000400000-0x000000000282D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads