gcleaner | 4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573.exe
Size

313KB
MD5

c2e1ebac5fdc8501474346e84fd3cb96
SHA1

370a36b265279e3fd920907ad0a367eb1bafab27
SHA256

4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573
SHA512

a45448bbd75716e2ac9d6489fd99969ef1e8c8963f777b85e59ae0aa81036ee37246b1f15bf72db2e7b4d625c751053ce487703c8847e7efa9852051d5e11b3b
SSDEEP

3072:En4wEI/3vnyFQ7i4XGL8vEUfCK2DQ3DepC2Fd/z/ThXV2831PXz+HtSY9/RC+AV0:SBnyFQHX08gps3UC2FNJCIhGe

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

92.63.197.221

45.91.200.135

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2860	2972	WerFault.exe	82
1116	2972	WerFault.exe	82
4964	2972	WerFault.exe	82
4500	2972	WerFault.exe	82
4112	2972	WerFault.exe	82
2836	2972	WerFault.exe	82
4416	2972	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573.exe

C:\Users\Admin\AppData\Local\Temp\4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573.exe
"C:\Users\Admin\AppData\Local\Temp\4a6b7593616266a80bf286fbb15f7d80dd611b94ee208dfc41b808f637e8b573.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 744
  2⤵
  - Program crash
  PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 784
  2⤵
  - Program crash
  PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 800
  2⤵
  - Program crash
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 848
  2⤵
  - Program crash
  PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 908
  2⤵
  - Program crash
  PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 908
  2⤵
  - Program crash
  PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 748
  2⤵
  - Program crash
  PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2972 -ip 2972
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2972 -ip 2972
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2972 -ip 2972
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2972 -ip 2972
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2972 -ip 2972
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2972 -ip 2972
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2972 -ip 2972
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-1-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/2972-2-0x00000000009C0000-0x00000000009FB000-memory.dmp

Filesize
236KB

Download
memory/2972-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2972-4-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/2972-6-0x00000000009C0000-0x00000000009FB000-memory.dmp

Filesize
236KB

Download
memory/2972-5-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/2972-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download