gcleaner | 82e0ed66e2650c788628836a9d26afd7c8abbecb0800e34404f8208f0b36f325

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
Size

358KB
MD5

20361cc8be77827bdda587164cd27e58
SHA1

305e5a975e4d1a04f2a5e0ec6295512bec4d0764
SHA256

82e0ed66e2650c788628836a9d26afd7c8abbecb0800e34404f8208f0b36f325
SHA512

134dba23772dce5cd474c3d0d653bdd9b5062296a8b92a95cf2a92b0f08ba55bf3b10db75d6dc4813acb4cb7e8fcd29618c63efeb7a41494d7ac415a2375f83b
SSDEEP

6144:LEx3NT4+Hbpb9BHyUxyeHeKwTZlCAURJL2IWmUSMtEG9+w2P4:g3lx7pb9BHykleKwuA3myswu4

Score

10^/10

gcleaner onlylogger discovery loader

Malware Config

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1892-2-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral2/memory/1892-3-0x0000000000400000-0x0000000000432000-memory.dmp	family_onlylogger
behavioral2/memory/1892-5-0x00000000001C0000-0x00000000001F0000-memory.dmp	family_onlylogger
behavioral2/memory/1892-6-0x0000000000400000-0x000000000090F000-memory.dmp	family_onlylogger
behavioral2/memory/1892-18-0x0000000000400000-0x000000000090F000-memory.dmp	family_onlylogger

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2328	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
4376	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
2032	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
3948	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
4912	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
2140	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
3728	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
3328	1892	WerFault.exe	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20361cc8be77827bdda587164cd27e58_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 636
  2⤵
  - Program crash
  PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 656
  2⤵
  - Program crash
  PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 784
  2⤵
  - Program crash
  PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 664
  2⤵
  - Program crash
  PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 760
  2⤵
  - Program crash
  PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1028
  2⤵
  - Program crash
  PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1036
  2⤵
  - Program crash
  PID:3728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1612
  2⤵
  - Program crash
  PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1892 -ip 1892
1⤵
PID:604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1892 -ip 1892
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1892 -ip 1892
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1892 -ip 1892
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1892 -ip 1892
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1892 -ip 1892
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1892 -ip 1892
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1892 -ip 1892
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-1-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1892-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1892-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1892-4-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1892-5-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1892-6-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/1892-18-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download