gcleaner | e9c6dda67b1da1be30f8b0d4c7ff329c6b9831ae2c413742bbe59cc66690a630

Analysis

max time kernel
298s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lapismixtwo.exe
Size 805KB
Sample260628-s473hsas4r
SHA256 e9c6dda67b1da1be30f8b0d4c7ff329c6b9831ae2c413742bbe59cc66690a630
MD5 3cc6072eca86948127764f87d84baa85
SHA1 1d0bf06fdc2505d6947d4b2825e888ab5148b68b
SHA512 be3e6d80126055fb87b124d292eeb00a6fbef93b82573f8ea070d57414d0ff22761af54f3f47f914c49e6c7bb67d51069405133ea0286a5af49a08337280cb8a
SSDEEP 12288:eKqXmsruZ1B3Stb8l8YCXa06b3Xwd4XZhOfOanhVEPVwjo47aUyqIFk:e9RSdCd8K7Gbnwd4XZ0fOi3ENKn7aQ
TLSH
T12B059E22A1E04837C1A35A3D8D2B9778A92BBE7139245D866BE43C4C8F37E513935377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1104 created 3268	1104	lapismixtwo.exe	56

Downloads MZ/PE file 11 IoCs

flow	pid	Process
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
21	2608	svchost.exe
34	2608	svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
4844	gtytpbqQHAswK.exe
932	rRLOudR68bhtC.exe
4244	lsSTwPMvLv1LK.exe
2268	Y3JYdTU18.exe
4816	IgX3qI1gs5N.exe
4588	1QJbLO5Q7aS.exe
1800	p7MLfV9WudT0.exe
3364	wccOFXt8oB1u.exe
4224	6vJqbq3RHD9.exe
4104	igGMFu3uLsAW.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 2608	1104	lapismixtwo.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lapismixtwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	lapismixtwo.exe
1104	lapismixtwo.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 1104 wrote to memory of 2608	1104	lapismixtwo.exe	88
PID 2608 wrote to memory of 4844	2608	svchost.exe	94
PID 2608 wrote to memory of 932	2608	svchost.exe	96
PID 2608 wrote to memory of 4244	2608	svchost.exe	99
PID 2608 wrote to memory of 2268	2608	svchost.exe	102
PID 2608 wrote to memory of 4816	2608	svchost.exe	105
PID 2608 wrote to memory of 4588	2608	svchost.exe	107
PID 2608 wrote to memory of 1800	2608	svchost.exe	109
PID 2608 wrote to memory of 3364	2608	svchost.exe	111
PID 2608 wrote to memory of 4224	2608	svchost.exe	113
PID 2608 wrote to memory of 4104	2608	svchost.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe
  "C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1104
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Roaming\m67ZI\gtytpbqQHAswK.exe
    "C:\Users\Admin\AppData\Roaming\m67ZI\gtytpbqQHAswK.exe"
    3⤵
    - Executes dropped EXE
    PID:4844
- - C:\Users\Admin\AppData\Roaming\QpTiL\rRLOudR68bhtC.exe
    "C:\Users\Admin\AppData\Roaming\QpTiL\rRLOudR68bhtC.exe"
    3⤵
    - Executes dropped EXE
    PID:932
- - C:\Users\Admin\AppData\Roaming\1hlSRmPU0pT\lsSTwPMvLv1LK.exe
    "C:\Users\Admin\AppData\Roaming\1hlSRmPU0pT\lsSTwPMvLv1LK.exe"
    3⤵
    - Executes dropped EXE
    PID:4244
- - C:\Users\Admin\AppData\Roaming\zHL0dUo\Y3JYdTU18.exe
    "C:\Users\Admin\AppData\Roaming\zHL0dUo\Y3JYdTU18.exe"
    3⤵
    - Executes dropped EXE
    PID:2268
- - C:\Users\Admin\AppData\Roaming\95iVvq\IgX3qI1gs5N.exe
    "C:\Users\Admin\AppData\Roaming\95iVvq\IgX3qI1gs5N.exe"
    3⤵
    - Executes dropped EXE
    PID:4816
- - C:\Users\Admin\AppData\Roaming\YK7E0r\1QJbLO5Q7aS.exe
    "C:\Users\Admin\AppData\Roaming\YK7E0r\1QJbLO5Q7aS.exe"
    3⤵
    - Executes dropped EXE
    PID:4588
- - C:\Users\Admin\AppData\Roaming\s8asV\p7MLfV9WudT0.exe
    "C:\Users\Admin\AppData\Roaming\s8asV\p7MLfV9WudT0.exe"
    3⤵
    - Executes dropped EXE
    PID:1800
- - C:\Users\Admin\AppData\Roaming\kOZ6J\wccOFXt8oB1u.exe
    "C:\Users\Admin\AppData\Roaming\kOZ6J\wccOFXt8oB1u.exe"
    3⤵
    - Executes dropped EXE
    PID:3364
- - C:\Users\Admin\AppData\Roaming\3vwUiM79\6vJqbq3RHD9.exe
    "C:\Users\Admin\AppData\Roaming\3vwUiM79\6vJqbq3RHD9.exe"
    3⤵
    - Executes dropped EXE
    PID:4224
- - C:\Users\Admin\AppData\Roaming\P0wM82u\igGMFu3uLsAW.exe
    "C:\Users\Admin\AppData\Roaming\P0wM82u\igGMFu3uLsAW.exe"
    3⤵
    - Executes dropped EXE
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

igGMFu3uLsAW.exe

Path C:\Users\Admin\AppData\Roaming\P0wM82u\igGMFu3uLsAW.exe
Size 10KB
SHA256 aba14a64c2427ab54db44a605d5b408d57e713b3a4d26a226b657c3f9fb12928
MD5 4bd321ac2163c30f557e5afcd182748d
SHA1 9aaa9c8c49fa50c7a8cbf55ffda6fdce704fec6f
SHA512 fa15e6f384b28f81292642e7a2ea9bb2e698dd402407a3f35e3220ccd5b4d7b9b6e8e0932015a15d1f4943e5a6101b1e4715002ef0417c06447b00489336e8a6
SSDEEP 192:i6fTPULD5G7eEyzMlVnhfyGjcuXl0mRiZSJWXFa4n:i6fTMLD5G7WgVn8Gj5XlQMJ8g
TLSH
T10F221BC4A35561EAD54D033FC522CD23E596F10582A1EABF90B4D2B79F42B436A3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtytpbqQHAswK.exe

Path C:\Users\Admin\AppData\Roaming\m67ZI\gtytpbqQHAswK.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-36-0x00007FF70BC80000-0x00007FF70BC8C000-memory.dmp

Download

memory/1104-0-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/1104-1-0x0000000000487000-0x0000000000488000-memory.dmp

Download

memory/1104-2-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1104-3-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1104-4-0x00000000022F0000-0x000000000231B000-memory.dmp

Download

memory/1800-61-0x00007FF69D510000-0x00007FF69D51C000-memory.dmp

Download

memory/2268-46-0x00007FF7EF2A0000-0x00007FF7EF2AC000-memory.dmp

Download

memory/2608-24-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2608-7-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/2608-12-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/2608-9-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/2608-5-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/2608-10-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/2608-8-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/2608-6-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/3364-66-0x00007FF7CC120000-0x00007FF7CC12C000-memory.dmp

Download

memory/4224-71-0x00007FF714030000-0x00007FF71403C000-memory.dmp

Download

memory/4244-41-0x00007FF68E6F0000-0x00007FF68E6FC000-memory.dmp

Download

memory/4588-56-0x00007FF653A30000-0x00007FF653A3C000-memory.dmp

Download

memory/4816-51-0x00007FF7AEEF0000-0x00007FF7AEEFC000-memory.dmp

Download

memory/4844-31-0x00007FF73C660000-0x00007FF73C66C000-memory.dmp

Download