Overview
overview
10Static
static
10PL/6523.exe
windows7-x64
10PL/6523.exe
windows10-2004-x64
10PL/Galaxy.exe
windows10-2004-x64
7PL/Service.exe
windows7-x64
6PL/Service.exe
windows10-2004-x64
6PL/Une1.exe
windows10-2004-x64
7PL/pb1115.exe
windows7-x64
7PL/pb1115.exe
windows10-2004-x64
7PL/setup.exe
windows7-x64
10PL/setup.exe
windows10-2004-x64
10PL/setup.exe
windows7-x64
10PL/setup.exe
windows10-2004-x64
8PL/setup331.exe
windows7-x64
7PL/setup331.exe
windows10-2004-x64
7Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-11-2024 17:46
Behavioral task
behavioral1
Sample
PL/6523.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
PL/6523.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
PL/Galaxy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
PL/Service.exe
Resource
win7-20241010-en
Behavioral task
behavioral5
Sample
PL/Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
PL/Une1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
PL/pb1115.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
PL/pb1115.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
PL/setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
PL/setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
PL/setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
PL/setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
PL/setup331.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
PL/setup331.exe
Resource
win10v2004-20241007-en
General
-
Target
PL/setup.exe
-
Size
352KB
-
MD5
ad3374b444437df5f5102ab63a45d327
-
SHA1
65302eb15520d64565e64e9cc74fdd09fbad79ef
-
SHA256
b3936ea34f4e0235a1715706b7736a6bf0999441c8c37f1f75b4250e7b9b9992
-
SHA512
0e569bd15a25649b7293b539118f77ca9920e7a835acd24b75bf6f33c3de3f7e5ddcf9675a6f174af6292f39e88cb6f380f0d1165ed0f1419de41e4348ae2463
-
SSDEEP
6144:tK/VQLDETxJSm8oMKGreTfbmBdbNB6yqpx4T50G3YilTuzbgwuds7wVfE:wNQExJjFGreDbmBNfCWdjunnp
Malware Config
Extracted
gcleaner
208.67.104.97
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
setup.exepid process 2464 setup.exe