Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 03:57 UTC

General

  • Target

    Mr4X5srRQR20TfuVZShfsrAN.exe

  • Size

    321KB

  • MD5

    94c78c311f499024a9f97cfdbb073623

  • SHA1

    50e91d3eaa06d2183bf8c6c411947304421c5626

  • SHA256

    6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e

  • SHA512

    29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545

  • SSDEEP

    6144:DQbZ65iKd8Ro5c7bW+7kUyptNv+6FsVAIXRwGA69PZ+9ElvczV:6Z65im8Rb7D7kUyP5cVAIhwGA69B+9uY

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • Onlylogger family
  • OnlyLogger payload 5 IoCs
  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mr4X5srRQR20TfuVZShfsrAN.exe
    "C:\Users\Admin\AppData\Local\Temp\Mr4X5srRQR20TfuVZShfsrAN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 636
      2⤵
      • Program crash
      PID:4848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 672
      2⤵
      • Program crash
      PID:3108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 652
      2⤵
      • Program crash
      PID:1572
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 784
      2⤵
      • Program crash
      PID:2540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1012
      2⤵
      • Program crash
      PID:1744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1072
      2⤵
      • Program crash
      PID:1340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1292
      2⤵
      • Program crash
      PID:4540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1016
      2⤵
      • Program crash
      PID:4920
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2336 -ip 2336
    1⤵
      PID:4552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2336 -ip 2336
      1⤵
        PID:3560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2336 -ip 2336
        1⤵
          PID:3976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2336 -ip 2336
          1⤵
            PID:1420
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2336 -ip 2336
            1⤵
              PID:1652
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2336 -ip 2336
              1⤵
                PID:4376
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2336 -ip 2336
                1⤵
                  PID:2340
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2336 -ip 2336
                  1⤵
                    PID:1192

                  Network

                  • flag-us
                    DNS
                    196.249.167.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    196.249.167.52.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    95.221.229.192.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    95.221.229.192.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    134.32.126.40.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    134.32.126.40.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    garbage-cleaner.biz
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    Remote address:
                    8.8.8.8:53
                    Request
                    garbage-cleaner.biz
                    IN A
                    Response
                  • flag-us
                    DNS
                    154.239.44.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    154.239.44.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    13.86.106.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    13.86.106.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    197.87.175.4.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    197.87.175.4.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    15.164.165.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    15.164.165.52.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    22.236.111.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    22.236.111.52.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    91.16.208.104.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    91.16.208.104.in-addr.arpa
                    IN PTR
                    Response
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 194.145.227.161:80
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    260 B
                    5
                  • 8.8.8.8:53
                    196.249.167.52.in-addr.arpa
                    dns
                    73 B
                    147 B
                    1
                    1

                    DNS Request

                    196.249.167.52.in-addr.arpa

                  • 8.8.8.8:53
                    95.221.229.192.in-addr.arpa
                    dns
                    73 B
                    144 B
                    1
                    1

                    DNS Request

                    95.221.229.192.in-addr.arpa

                  • 8.8.8.8:53
                    134.32.126.40.in-addr.arpa
                    dns
                    72 B
                    158 B
                    1
                    1

                    DNS Request

                    134.32.126.40.in-addr.arpa

                  • 8.8.8.8:53
                    garbage-cleaner.biz
                    dns
                    Mr4X5srRQR20TfuVZShfsrAN.exe
                    65 B
                    127 B
                    1
                    1

                    DNS Request

                    garbage-cleaner.biz

                  • 8.8.8.8:53
                    154.239.44.20.in-addr.arpa
                    dns
                    72 B
                    158 B
                    1
                    1

                    DNS Request

                    154.239.44.20.in-addr.arpa

                  • 8.8.8.8:53
                    13.86.106.20.in-addr.arpa
                    dns
                    71 B
                    157 B
                    1
                    1

                    DNS Request

                    13.86.106.20.in-addr.arpa

                  • 8.8.8.8:53
                    197.87.175.4.in-addr.arpa
                    dns
                    71 B
                    157 B
                    1
                    1

                    DNS Request

                    197.87.175.4.in-addr.arpa

                  • 8.8.8.8:53
                    15.164.165.52.in-addr.arpa
                    dns
                    72 B
                    146 B
                    1
                    1

                    DNS Request

                    15.164.165.52.in-addr.arpa

                  • 8.8.8.8:53
                    22.236.111.52.in-addr.arpa
                    dns
                    72 B
                    158 B
                    1
                    1

                    DNS Request

                    22.236.111.52.in-addr.arpa

                  • 8.8.8.8:53
                    91.16.208.104.in-addr.arpa
                    dns
                    72 B
                    146 B
                    1
                    1

                    DNS Request

                    91.16.208.104.in-addr.arpa

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2336-1-0x0000000002450000-0x0000000002550000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2336-2-0x0000000002550000-0x0000000002580000-memory.dmp

                    Filesize

                    192KB

                  • memory/2336-3-0x0000000000400000-0x0000000000432000-memory.dmp

                    Filesize

                    200KB

                  • memory/2336-4-0x0000000002450000-0x0000000002550000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2336-6-0x0000000002550000-0x0000000002580000-memory.dmp

                    Filesize

                    192KB

                  • memory/2336-5-0x0000000000400000-0x00000000023BB000-memory.dmp

                    Filesize

                    31.7MB

                  • memory/2336-7-0x0000000000400000-0x0000000000432000-memory.dmp

                    Filesize

                    200KB

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.