Analysis

  • max time kernel
    101s
  • max time network
    139s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:26

General

  • Target

    d31f0543792df2de66f3a6fd6d75491ba1e84a5969f2091a17b22e697189ca0b.exe

  • Size

    4.8MB

  • MD5

    a74a5b502a4ee04b7bfbede98dbbc06d

  • SHA1

    c80dbac460717576db6721741e8f4cc547435fab

  • SHA256

    d31f0543792df2de66f3a6fd6d75491ba1e84a5969f2091a17b22e697189ca0b

  • SHA512

    b7184252f0a0644f3b014ff1b26d92e57ac6e540e12e57a6625c315401e71bef90abf5402d0a7848950539ed0c90ecf8d77dc189f6fd3179de115f9a04df2ae6

  • SSDEEP

    98304:Sg9nYKv9bdaKeEdpDq1qK2aU93XdXOH3HPeW:SENNoEfDwqI4W

Malware Config

Extracted

Family

gcleaner

C2

45.91.200.135

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d31f0543792df2de66f3a6fd6d75491ba1e84a5969f2091a17b22e697189ca0b.exe
    "C:\Users\Admin\AppData\Local\Temp\d31f0543792df2de66f3a6fd6d75491ba1e84a5969f2091a17b22e697189ca0b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6116
    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GKCUTU87\service[1].htm

          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe

          Filesize

          2.6MB

          MD5

          ceeae1523c3864b719e820b75bf728aa

          SHA1

          cf607927b6ef864a11bf7ebbcdbb59891d23d320

          SHA256

          4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71

          SHA512

          a06da3b96084040d49964b2227402ff1a2548ee5f1459df6b64bc6cbb271f19a00a798333e0f608d03c5a6de7355ae916309250204900117e3ef101f764d0f5f

        • memory/5528-26-0x0000000010000000-0x000000001001C000-memory.dmp

          Filesize

          112KB

        • memory/5528-10-0x0000000000430000-0x000000000045F000-memory.dmp

          Filesize

          188KB

        • memory/5528-23-0x0000000000430000-0x000000000045F000-memory.dmp

          Filesize

          188KB

        • memory/5528-31-0x0000000000430000-0x000000000045F000-memory.dmp

          Filesize

          188KB

        • memory/5528-51-0x0000000000430000-0x000000000045F000-memory.dmp

          Filesize

          188KB

        • memory/6116-4-0x0000000000400000-0x00000000008D0000-memory.dmp

          Filesize

          4.8MB

        • memory/6116-3-0x0000000000400000-0x00000000008D0000-memory.dmp

          Filesize

          4.8MB

        • memory/6116-2-0x0000000002740000-0x0000000002741000-memory.dmp

          Filesize

          4KB

        • memory/6116-0-0x0000000002740000-0x0000000002741000-memory.dmp

          Filesize

          4KB

        • memory/6116-1-0x0000000000470000-0x0000000000471000-memory.dmp

          Filesize

          4KB