cleanuploader | 40678643ade16f4bb14659ab1918206f588ed8bb1d64a44b519b8c99a5bb80df

Resubmissions

03/10/2025, 07:22

251003-h7d9haak9v10

23/03/2024, 14:28

240323-rtatlabb8s10

13/02/2024, 16:52

240213-vdjy4sed478

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2025, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChromeSetup_v1.3.87.370.exe
Size 1.2MB
Sample251003-h7d9haak9v
SHA256 40678643ade16f4bb14659ab1918206f588ed8bb1d64a44b519b8c99a5bb80df
MD5 2b62dd154b431d8309002d5b4a35de07
SHA1 2216268cd5af2036f5904bb394caef475ea12e6e
SHA512 93d101ca706faef9a8967d229b2ff500909ea6a51e010e8b620f5cbc568188b172e25325ea7d0eccb62fa0584ae5d125daacc9588bb6a65aad69f0cde5ac0fe0
SSDEEP 24576:N5xO1W494JjgIt+3/7BtKK9lIFeu0NBXcajul+t5QiYnWXwkL3yrLzUCU5h5/:8W494JjgI0TBtK4lye5BsajuuOPsL3yE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery cleanuploader persistence privilege_escalation trojan

Malware Config

Extracted

Family

cleanuploader

https://basiconlineincome.com/

Attributes

c2_uris
api/connect

api/session
dll_version
v1.4 #Opera

Signatures

CleanUpLoader, Oyster
CleanUpLoader aka Oyster is a remote access trojan written in C++, first observed in July 2023.
trojan cleanuploader
Cleanuploader family
cleanuploader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	ChromeSetup_v1.3.87.370.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
4748	cleanmgr.exe
2272	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Disk Cleanup = "C:\\Windows\\SysWOW64\\cleanmgr.exe /verylowdisk"	ChromeSetup_v1.3.87.370.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup_v1.3.87.370.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DiskClr\\DiskClr_v7.7.dll"	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}\InprocServer32	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}\InprocServer32	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\WOW6432Node	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}\InprocServer32	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\WOW6432Node\CLSID	ChromeSetup_v1.3.87.370.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\WOW6432Node\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}	ChromeSetup_v1.3.87.370.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4748	cleanmgr.exe
4748	cleanmgr.exe
2272	rundll32.exe
2272	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4748	2808	cmd.exe	94
PID 2808 wrote to memory of 4748	2808	cmd.exe	94
PID 2808 wrote to memory of 4748	2808	cmd.exe	94
PID 5628 wrote to memory of 988	5628	ChromeSetup_v1.3.87.370.exe	95
PID 5628 wrote to memory of 988	5628	ChromeSetup_v1.3.87.370.exe	95
PID 5628 wrote to memory of 988	5628	ChromeSetup_v1.3.87.370.exe	95
PID 4748 wrote to memory of 2272	4748	cleanmgr.exe	97
PID 4748 wrote to memory of 2272	4748	cleanmgr.exe	97
PID 4748 wrote to memory of 2272	4748	cleanmgr.exe	97

C:\Users\Admin\AppData\Local\Temp\ChromeSetup_v1.3.87.370.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeSetup_v1.3.87.370.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\SysWOW64\cleanmgr.exe
  "C:\Windows\SysWOW64\cleanmgr.exe" /verylowdisk
  2⤵
  - System Location Discovery: System Language Discovery
  PID:988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\cleanmgr.exe /verylowdisk
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\cleanmgr.exe
  C:\Windows\SysWOW64\cleanmgr.exe /verylowdisk
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DiskClr\DiskClr_v7.7.dll,Cleaner
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiskClr_v7.7.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskClr\DiskClr_v7.7.dll
Size 1011KB
SHA256 1f421a7b26672dbc3fbf44228707d71c91e8e354bd4ac2f0581ac6a3cd54b4fb
MD5 941fe1e92f6886ab4669f59f0ca46699
SHA1 47a31e30d878b963322efa758a7a0dcf1a661f20
SHA512 9fd45b32731c48a41d1d77537e68d2312f1d9a9343ee8c932ecbc841361226077354d4a860bc0e8aa26d1c78eb86d22f535c30b9bcdbe34cae2493cf6ff332b5
SSDEEP 24576:91trRSTMg53uaC87LWApE9w66K8LpG/2NhoQSVqeWT/dXnOD8A6Ku:pNKrC87LWAK9C3pG/2NhoA3V3Ku
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2272-6-0x00000000009A0000-0x00000000009B3000-memory.dmp

Download

memory/4748-3-0x00000000037E0000-0x0000000003855000-memory.dmp

Download

memory/4748-4-0x00000000037E0000-0x0000000003855000-memory.dmp

Download