gcleaner | d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe
Size 2.7MB
Sample260729-msdrmssajd
SHA256 d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835
MD5 127f833a0f80b73664cfa547065265da
SHA1 b2c29d38103a0ebbaeed3d575efeb8da989d17a7
SHA512 7f8f07ee354d3b5831d478a7297efd46e87186f865d92fa6d515eb35c1e7dfe211f3f681a6db0b0c2c1e5b5ef945a7fab945ea544d9244ce15c2350aea4e35b7
SSDEEP 49152:bdo+yqWbQ+TscTI96A9EjcfmITpp9elSpRF+5MvD6QpwU9iBlaAj8:2+yqWbQ+4c09JejcuITpvpSkJpwHBlRj
TLSH
T14ED53304A289CA22C1884776C9F1F0761774DD48F51BF2AF7AEC6EDBB2133391D54992
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gcleaner remus_stealer loader stealer

Malware Config

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Extracted

Family

remus_stealer

http://zelpx.garden:9895
http://tzpx.courses:4437
http://carogra.biz:4219

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 4 IoCs

pid	Process
5440	KK60UnxzcdF7CH6.exe
1372	17.exe
204	KK60UnxzcdF7CH6.exe
2288	17.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3916-7-0x00000000059F0000-0x0000000005A00000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 5440 set thread context of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 1372 set thread context of 2288	1372	17.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KK60UnxzcdF7CH6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KK60UnxzcdF7CH6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 3916 wrote to memory of 1776	3916	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	89
PID 1776 wrote to memory of 5440	1776	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	90
PID 1776 wrote to memory of 1372	1776	d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe	91
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 5440 wrote to memory of 204	5440	KK60UnxzcdF7CH6.exe	92
PID 1372 wrote to memory of 2288	1372	17.exe	93
PID 1372 wrote to memory of 2288	1372	17.exe	93
PID 1372 wrote to memory of 2288	1372	17.exe	93
PID 1372 wrote to memory of 2288	1372	17.exe	93
PID 1372 wrote to memory of 2288	1372	17.exe	93
PID 1372 wrote to memory of 2288	1372	17.exe	93

C:\Users\Admin\AppData\Local\Temp\d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe
"C:\Users\Admin\AppData\Local\Temp\d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe
  "C:\Users\Admin\AppData\Local\Temp\d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\KK60UnxzcdF7CH6.exe
    "C:\Users\Admin\AppData\Local\Temp\KK60UnxzcdF7CH6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\KK60UnxzcdF7CH6.exe
      "C:\Users\Admin\AppData\Local\Temp\KK60UnxzcdF7CH6.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:204
- - C:\Users\Admin\AppData\Local\Temp\17.exe
    "C:\Users\Admin\AppData\Local\Temp\17.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\17.exe
      C:\Users\Admin\AppData\Local\Temp\17.exe
      4⤵
      Executes dropped EXE
      PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17.exe

Path C:\Users\Admin\AppData\Local\Temp\17.exe
Size 1.0MB
SHA256 639b624b8751cb9dbc94f6706484493565942b8c409c9c40aa727a50fabd53c5
MD5 c97fdc2ead5ecc414ef6c23fcecea967
SHA1 c618b731f7d0836644ba23d55e7146c5707a5c87
SHA512 a53607ee9286325af1997422926fa50cca9a65b3f0fa19ac1ecaf219d6b4b681c8208c018f3dddbb0c3e162a5e620288564d2dccc74e8c2c3098d0edd1d7b669
SSDEEP 12288:7U+icqIRBI23qW+m2iI2gf/EJ9mLLBRukJB87vJYo6lSrAsPbXmeiJP/eH/tfIxm:7U+ighWma1L2kEmZ0oeHlfmP3q8qQC
TLSH
T15C352221E79EC623C5580B3288E2F6B103A88F89F153D76F5FDC6DE7B5237924A51241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KK60UnxzcdF7CH6.exe

Path C:\Users\Admin\AppData\Local\Temp\KK60UnxzcdF7CH6.exe
Size 957KB
SHA256 cb8d68041200958ef7c8b1c5d5cb82c2545f2d89b67dd49c564242f2f009362c
MD5 f651e9225960daeb8dfb96c3da275294
SHA1 34b5e8d7449ce558ec9aafc624e996844614a614
SHA512 8cfc7a3778fe2bcd77f50d503e155b4b19d1e1c7d98c9f32767e4cf6f795d4b51102bb9842bc7faa2bda5810a88b32c5ec51b3168e65688e5d2175fa99adbbe0
SSDEEP 24576:enODWmdY07kLqqUIgHYBzGZboBpMPQUeKRWD0Uy88PwPl:2KY0djIEYBzgborMPRRdUy8
TLSH
T1362522A157EAC117C548033159E2E37203B8CE88F963DA6B5FDDAEC7B92375A5C41382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-47-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/204-45-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1372-44-0x000001D954A50000-0x000001D954B2C000-memory.dmp

Download

memory/1372-40-0x000001D939620000-0x000001D939728000-memory.dmp

Download

memory/1776-11-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/1776-39-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/1776-13-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/1776-16-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/2288-48-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/3916-7-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/3916-5-0x00000000058F0000-0x000000000598C000-memory.dmp

Download

memory/3916-9-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3916-17-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3916-8-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/3916-10-0x0000000007020000-0x00000000072A0000-memory.dmp

Download

memory/3916-1-0x00000000009A0000-0x0000000000C5C000-memory.dmp

Download

memory/3916-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/3916-2-0x0000000005DE0000-0x000000000639A000-memory.dmp

Download

memory/3916-4-0x0000000005830000-0x000000000583A000-memory.dmp

Download

memory/3916-6-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3916-3-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/5440-29-0x0000000074402000-0x0000000074403000-memory.dmp

Download

memory/5440-43-0x00000000063A0000-0x0000000006468000-memory.dmp

Download

memory/5440-42-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/5440-41-0x0000000074402000-0x0000000074403000-memory.dmp

Download

memory/5440-34-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/5440-26-0x00000000002B0000-0x00000000003A6000-memory.dmp

Download

memory/5440-50-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads