gcleaner | dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe
Size

2.2MB
MD5

3cbbdde564427795fab90fdddb4ecf05
SHA1

83863a0e3e256e4b03e6d22f49d2371e342f34e2
SHA256

dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd
SHA512

960c30e38478bcca903dce6c772f0d022596c6ecd669d77f6846f68638a1003a59c990e0de36aa5acefe94fdc72dc286ce063e38a3602dd67d95f5865d989d2d
SSDEEP

24576:Cmd/rw97o4zo2hM3Mr7KcxHxNhW1DdcRA4/L69B83/g8WW+3vh8bWXmMmmQfB2m0:LETRlr7KcJQEBo8WWaZTXoL2mcSde7w8

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

208.67.106.156

87.251.71.107

193.151.183.73

208.67.104.141

Attributes

url_path
/i.php

/get.php

/setup.php

/setup.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe

C:\Users\Admin\AppData\Local\Temp\dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe
"C:\Users\Admin\AppData\Local\Temp\dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x0000000000400000-0x000000000142E000-memory.dmp

Filesize
16.2MB

Download
memory/2408-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2408-1-0x0000000000400000-0x000000000142E000-memory.dmp

Filesize
16.2MB

Download
memory/2408-3-0x0000000000400000-0x000000000142E000-memory.dmp

Filesize
16.2MB

Download
memory/2408-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download