gcleaner | f211d8be8001df12bba948be8bdb8db9c938a518052a50d358d02a04396c2dd5

General

Target

e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe
Size

281KB
MD5

e7670118fd4bd720b70a799bc68860b9
SHA1

5bc054649f120473e2e022ba0e628c20649724e8
SHA256

f211d8be8001df12bba948be8bdb8db9c938a518052a50d358d02a04396c2dd5
SHA512

9f2edecedf05e2d0dc83e1932910bca94bf1878643719aacfc1e04d96b6702a12400b0f9259db01c46e920963293907edab12e575476f06f459c965ce8292e1c
SSDEEP

6144:6dk2Sqt6RT2VN8ODCQKvZLBAyPEhUad4eGsU9eR:v2d6R6VN8ODqBLS+9ad4egeR

Score

10^/10

gcleaner onlylogger discovery loader

Malware Config

Extracted

Family

gcleaner

C2

gc-prtnrs.top

gcc-prtnrs.top

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Onlylogger family
onlylogger

OnlyLogger payload 5 IoCs

resource	yara_rule
behavioral2/memory/4644-2-0x0000000002210000-0x000000000223E000-memory.dmp	family_onlylogger
behavioral2/memory/4644-3-0x0000000000400000-0x0000000000431000-memory.dmp	family_onlylogger
behavioral2/memory/4644-5-0x0000000000400000-0x00000000004CA000-memory.dmp	family_onlylogger
behavioral2/memory/4644-6-0x0000000002210000-0x000000000223E000-memory.dmp	family_onlylogger
behavioral2/memory/4644-7-0x0000000000400000-0x0000000000431000-memory.dmp	family_onlylogger

Program crash 11 IoCs

pid	pid_target	Process	procid_target
640	4644	WerFault.exe	83
4964	4644	WerFault.exe	83
1944	4644	WerFault.exe	83
1624	4644	WerFault.exe	83
3644	4644	WerFault.exe	83
4968	4644	WerFault.exe	83
4900	4644	WerFault.exe	83
4456	4644	WerFault.exe	83
4104	4644	WerFault.exe	83
376	4644	WerFault.exe	83
2860	4644	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7670118fd4bd720b70a799bc68860b9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 460
  2⤵
  - Program crash
  PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 648
  2⤵
  - Program crash
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 696
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 828
  2⤵
  - Program crash
  PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 948
  2⤵
  - Program crash
  PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 808
  2⤵
  - Program crash
  PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1172
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1176
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1544
  2⤵
  - Program crash
  PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 844
  2⤵
  - Program crash
  PID:376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1168
  2⤵
  - Program crash
  PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4644 -ip 4644
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4644 -ip 4644
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4644 -ip 4644
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4644 -ip 4644
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4644 -ip 4644
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4644 -ip 4644
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4644 -ip 4644
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4644 -ip 4644
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4644 -ip 4644
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4644 -ip 4644
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4644 -ip 4644
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4644-2-0x0000000002210000-0x000000000223E000-memory.dmp

Filesize
184KB

Download
memory/4644-1-0x0000000000730000-0x0000000000830000-memory.dmp

Filesize
1024KB

Download
memory/4644-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4644-4-0x0000000000730000-0x0000000000830000-memory.dmp

Filesize
1024KB

Download
memory/4644-5-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4644-6-0x0000000002210000-0x000000000223E000-memory.dmp

Filesize
184KB

Download
memory/4644-7-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing