Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 03:28
General
-
Target
e8004da7a3c79934e0234cf767e38363368899050858a81dfd31b2010395d40c.exe
-
Size
1.9MB
-
MD5
99a31354f39549f085e6ffc213da9332
-
SHA1
35bc861303e0085349919376dc3ecd87f2c00264
-
SHA256
e8004da7a3c79934e0234cf767e38363368899050858a81dfd31b2010395d40c
-
SHA512
fb38c1e4126c9ced52b40977ba67eab30b698c481c3bb1107b45b656e02a20839d977d4f0ec0de384c6cc465c19870849cef219a7d0a109fa2b21aaa3a6de4b1
-
SSDEEP
49152:f/F1FCaosiD+BvKbfDXbPDM6nfx4YeuQryF:nFmn+lebDDM6fxDQE
Malware Config
Extracted
gcleaner
92.63.197.221
45.91.200.135
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8004da7a3c79934e0234cf767e38363368899050858a81dfd31b2010395d40c.exe"C:\Users\Admin\AppData\Local\Temp\e8004da7a3c79934e0234cf767e38363368899050858a81dfd31b2010395d40c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
152KB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB