gcleaner | f955357b63c775908bf0c702307ef92cb996cbc64cfa5fc27958a59b1a5964b1

General

Target

2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe
Size

56.5MB
MD5

f31b509490ee7ab50e30dfd335ef4250
SHA1

d8e76f0064dd77eda546f710c843e7085f8b590e
SHA256

f955357b63c775908bf0c702307ef92cb996cbc64cfa5fc27958a59b1a5964b1
SHA512

b7dec130be1fab4a0407b8d007b40fce5ae4943948f332e43db428d0be9b3d4f0a70ed20d692f72fc4c29fb05128ad37a389f55991af213a61f3fab6ad456e56
SSDEEP

393216:iywCAqwUBzBwiwxwGwPewgxwUwswMw8wJwVwtwiwPwxwUwfwOwgadKY5OBF1/f:wczxJKP3

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe

Executes dropped EXE 3 IoCs

pid	Process
5808	uniqq.exe
3816	svchost015.exe
4968	KMSAuto Net.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5808 set thread context of 3816	5808	uniqq.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uniqq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSAuto Net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4968	KMSAuto Net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1508	AUDIODG.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 5808	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	89
PID 5900 wrote to memory of 5808	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	89
PID 5900 wrote to memory of 5808	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	89
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5808 wrote to memory of 3816	5808	uniqq.exe	95
PID 5900 wrote to memory of 4968	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	96
PID 5900 wrote to memory of 4968	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	96
PID 5900 wrote to memory of 4968	5900	2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe	96
PID 4968 wrote to memory of 4092	4968	KMSAuto Net.exe	98
PID 4968 wrote to memory of 4092	4968	KMSAuto Net.exe	98
PID 4968 wrote to memory of 4092	4968	KMSAuto Net.exe	98
PID 4968 wrote to memory of 4888	4968	KMSAuto Net.exe	100
PID 4968 wrote to memory of 4888	4968	KMSAuto Net.exe	100
PID 4968 wrote to memory of 4888	4968	KMSAuto Net.exe	100
PID 4968 wrote to memory of 448	4968	KMSAuto Net.exe	102
PID 4968 wrote to memory of 448	4968	KMSAuto Net.exe	102

C:\Users\Admin\AppData\Local\Temp\2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\uniqq.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\uniqq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\uniqq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3816
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMSAuto Net.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMSAuto Net.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md "C:\Users\Admin\AppData\Local\MSfree Inc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo test>>"C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.test"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test"
    3⤵
    PID:448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A0YW8B0D\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMSAuto Net.exe

Filesize
8.4MB

MD5
2fb86be791b4bb4389e55df0fec04eb7

SHA1
375dc8189059602f9eb571b473d723fad3ad3d8c

SHA256
b8aec57f7e9c193fcd9796cf22997605624b8b5f9bf5f0c6190e1090d426ee31

SHA512
3230ab05eb876879aefc5e15bb726292640c1ddf476e4108f5c8eed2f373cb852964163ccb006e3d22bc1dc2f97ac2db391af9b289f21a7b099df4c4dd94ee38

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.test

Filesize
6B

MD5
9f06243abcb89c70e0c331c61d871fa7

SHA1
fde773a18bb29f5ed65e6f0a7aa717fd1fa485d4

SHA256
837ccb607e312b170fac7383d7ccfd61fa5072793f19a25e75fbacb56539b86b

SHA512
b947b99d1baddd347550c9032e9ab60b6be56551cf92c076b38e4e11f436051a4af51c47e54f8641316a720b043641a3b3c1e1b01ba50445ea1ba60bfd1b7a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\uniqq.exe

Filesize
47.7MB

MD5
4deb9680c78fbbccc88c45ef34c64766

SHA1
4030ae0ddc2bc14dbac2b0f9cbc8a0bf5052ee76

SHA256
bd00584463e2f3f1ab4ba3eafd1d3ce9f500bf82915dea960f290b2862ff22cb

SHA512
4655ee63a2d7fd379509dc6b4df9239130e61bc067786ce23e4d5dbc04edc3ebe612fe5fe7627221d6fbf2e366a8dddc07d1c611fa51d3ed177852860ca4f38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
memory/3816-22-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-23-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-18-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-50-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3816-47-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-46-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3816-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4968-40-0x00000000059B0000-0x0000000005A06000-memory.dmp

Filesize
344KB

Download
memory/4968-39-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/4968-38-0x0000000005780000-0x0000000005812000-memory.dmp

Filesize
584KB

Download
memory/4968-37-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/4968-36-0x0000000005640000-0x00000000056DC000-memory.dmp

Filesize
624KB

Download
memory/4968-35-0x0000000000430000-0x0000000000C90000-memory.dmp

Filesize
8.4MB

Download
memory/5808-21-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/5808-16-0x0000000003230000-0x000000000370D000-memory.dmp

Filesize
4.9MB

Download
memory/5808-14-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing