Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/07/2024, 11:10 UTC

General

  • Target

    571ce5be44aa36b68f2dbe9c0441dff0_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    571ce5be44aa36b68f2dbe9c0441dff0

  • SHA1

    4d7af48e8efbb0887e5b11dfffb6f43f7061efc7

  • SHA256

    dfeb2329e476e441a5f55e0dfd5c053d75f31a17863b200feab29cb5fb67137b

  • SHA512

    7cb66b0cf78153bca2b1e88ca00420503eb085ede980fd568599036da626755febaf7726351492b079ae3ee8f80173ab35f9121ad7c7a0aa864e2546964a3134

  • SSDEEP

    6144:2A8wwGmaue93Ae9dW0LE1opJWozwPlMWwtTI3hij04ZfehR:+wwGTR9Qe9djE1mWhctWEj0ue

Malware Config

Extracted

Family

gcleaner

C2

gcleaner.pro

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\571ce5be44aa36b68f2dbe9c0441dff0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\571ce5be44aa36b68f2dbe9c0441dff0_JaffaCakes118.exe"
    1⤵
      PID:2872

    Network

    • flag-us
      DNS
      gcleaner.pro
      571ce5be44aa36b68f2dbe9c0441dff0_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      gcleaner.pro
      IN A
      Response
    No results found
    • 8.8.8.8:53
      gcleaner.pro
      dns
      571ce5be44aa36b68f2dbe9c0441dff0_JaffaCakes118.exe
      58 B
      140 B
      1
      1

      DNS Request

      gcleaner.pro

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2872-1-0x0000000000400000-0x0000000002BCF000-memory.dmp

      Filesize

      39.8MB

    • memory/2872-2-0x0000000000400000-0x0000000002BCF000-memory.dmp

      Filesize

      39.8MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.