gcleaner | c54699a313556a143ce76e644f372233268433fb999f0176e37f610c15259bab

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb9bccc442d6b508d152d65a450f9b7e.exe
Size

313KB
MD5

eb9bccc442d6b508d152d65a450f9b7e
SHA1

acd44eae521547d86d06c2da37b49f541f675e9f
SHA256

c54699a313556a143ce76e644f372233268433fb999f0176e37f610c15259bab
SHA512

aa6e51637c766234d14ef37968be40cd957c76857c7531cb04a542743c04866e63604bb033b1d6288aec536a9453d3aeece5a7a6ea5b2087c59b3cacae60cf22
SSDEEP

6144:G66KVFow0i53eNTMEAnT/v3saQQ40r3RQ:7lVwNfArsaQKW

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

92.63.197.221

45.91.200.135

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3840	2816	WerFault.exe	81
2552	2816	WerFault.exe	81
4592	2816	WerFault.exe	81
2568	2816	WerFault.exe	81
1604	2816	WerFault.exe	81
928	2816	WerFault.exe	81
2040	2816	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb9bccc442d6b508d152d65a450f9b7e.exe

C:\Users\Admin\AppData\Local\Temp\eb9bccc442d6b508d152d65a450f9b7e.exe
"C:\Users\Admin\AppData\Local\Temp\eb9bccc442d6b508d152d65a450f9b7e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 744
  2⤵
  - Program crash
  PID:3840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 752
  2⤵
  - Program crash
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 804
  2⤵
  - Program crash
  PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 868
  2⤵
  - Program crash
  PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 908
  2⤵
  - Program crash
  PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 984
  2⤵
  - Program crash
  PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 768
  2⤵
  - Program crash
  PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2816 -ip 2816
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2816 -ip 2816
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2816 -ip 2816
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2816 -ip 2816
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2816 -ip 2816
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2816 -ip 2816
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2816 -ip 2816
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-2-0x00000000009D0000-0x0000000000A0B000-memory.dmp

Filesize
236KB

Download
memory/2816-1-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/2816-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2816-4-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/2816-6-0x00000000009D0000-0x0000000000A0B000-memory.dmp

Filesize
236KB

Download
memory/2816-5-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/2816-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download