gcleaner | f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae

General

Target
f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe
Size 260KB
Sample240710-rt28vavhka
SHA256 f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae
MD5 4f84fd32b8e4acec944be004180560b3
SHA1 cefdf334479301570902001047ce65167ce1cf09
SHA512 4378daefdb46c2787a0876b78bc18bd5dc3f2ddd8d90d32117208eae2d676c0570907bf493394ef8a69ec04f5d23968c78ff82989510771eba1059e89012f04f
SSDEEP 6144:CfeMS88Gw42+htAd3ZMKGs0Z9+JFdD49T:CFz25Zyts0/+JFde
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90
77.105.160.30
185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4580	3952	WerFault.exe	79
884	3952	WerFault.exe	79
2804	3952	WerFault.exe	79
4900	3952	WerFault.exe	79
1888	3952	WerFault.exe	79
1848	3952	WerFault.exe	79
2232	3952	WerFault.exe	79
4884	3952	WerFault.exe	79
4932	3952	WerFault.exe	79
3108	3952	WerFault.exe	79

Kills process with taskkill 1 IoCs

evasion

pid	Process
4020	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2120	3952	f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe	100
PID 3952 wrote to memory of 2120	3952	f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe	100
PID 3952 wrote to memory of 2120	3952	f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe	100
PID 2120 wrote to memory of 4020	2120	cmd.exe	104
PID 2120 wrote to memory of 4020	2120	cmd.exe	104
PID 2120 wrote to memory of 4020	2120	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe
"C:\Users\Admin\AppData\Local\Temp\f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 480
  2⤵
  - Program crash
  PID:4580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 484
  2⤵
  - Program crash
  PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 784
  2⤵
  - Program crash
  PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 804
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 848
  2⤵
  - Program crash
  PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 876
  2⤵
  - Program crash
  PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 960
  2⤵
  - Program crash
  PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 964
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1452
  2⤵
  - Program crash
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "f4ad4e8cbd93ece1ac31da4849dc6aae16888307778a909d893f87f46defb0ae.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1396
  2⤵
  - Program crash
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3952 -ip 3952
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3952 -ip 3952
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3952 -ip 3952
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3952 -ip 3952
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3952 -ip 3952
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3952 -ip 3952
1⤵
PID:600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3952 -ip 3952
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3952 -ip 3952
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-1-0x0000000002A00000-0x0000000002B00000-memory.dmp

Download

memory/3952-2-0x00000000046B0000-0x00000000046EC000-memory.dmp

Download

memory/3952-3-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3952-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3952-6-0x00000000046B0000-0x00000000046EC000-memory.dmp

Download

memory/3952-5-0x0000000000400000-0x0000000002827000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads