Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-11-2024 17:46

General

  • Target

    PL/setup.exe

  • Size

    352KB

  • MD5

    ad3374b444437df5f5102ab63a45d327

  • SHA1

    65302eb15520d64565e64e9cc74fdd09fbad79ef

  • SHA256

    b3936ea34f4e0235a1715706b7736a6bf0999441c8c37f1f75b4250e7b9b9992

  • SHA512

    0e569bd15a25649b7293b539118f77ca9920e7a835acd24b75bf6f33c3de3f7e5ddcf9675a6f174af6292f39e88cb6f380f0d1165ed0f1419de41e4348ae2463

  • SSDEEP

    6144:tK/VQLDETxJSm8oMKGreTfbmBdbNB6yqpx4T50G3YilTuzbgwuds7wVfE:wNQExJjFGreDbmBNfCWdjunnp

Malware Config

Extracted

Family

gcleaner

C2

208.67.104.97

85.31.46.167

107.182.129.235

171.22.30.106

Attributes
  • url_path

    ....!..../software.php

    ....!..../software.php

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PL\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2464-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

    Filesize

    1024KB

  • memory/2464-2-0x0000000000250000-0x000000000028F000-memory.dmp

    Filesize

    252KB

  • memory/2464-3-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2464-4-0x00000000005B0000-0x00000000006B0000-memory.dmp

    Filesize

    1024KB

  • memory/2464-5-0x0000000000250000-0x000000000028F000-memory.dmp

    Filesize

    252KB

  • memory/2464-6-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2464-7-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB