gcleaner | cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/09/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe
Size 3.3MB
Sample260911-2ae93stfpg
SHA256 cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b
MD5 d72e285f04b79faf6c43cf4a0a3d7d54
SHA1 662e611f513bfd2bd75a438da3649d7d0634a314
SHA512 f4f24d7265f412a678a21a859e692cc5624e10f121c486a8455be459aa51f63847acdc3d027093e2d662b3df00378a38c27836a5a1000111553af0d94111f23e
SSDEEP 98304:lDaS8oMw4urT5XoFii5RXJ/mhXliAFLMvxfW5bRTJApg57Tz:lOLh2o/m/ioT3JAO3
TLSH
T1E7F5025260923339D37B5AF449274B20C452BD877AB0F049F6F6509FDF22F86A51CAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Downloads MZ/PE file 5 IoCs

flow	pid	Process
17	4528	svchost015.exe
17	4528	svchost015.exe
17	4528	svchost015.exe
17	4528	svchost015.exe
17	4528	svchost015.exe

Executes dropped EXE 5 IoCs

pid	Process
4528	svchost015.exe
1712	sDyeB75Uf.exe
5620	RyLvV9ETP.exe
2548	q7FNdImHdZxC.exe
1540	YGed8o8vsws.exe

Loads dropped DLL 1 IoCs

pid	Process
4528	svchost015.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4440 set thread context of 4528	4440	jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4528	4440	jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe	83
PID 4528 wrote to memory of 1712	4528	svchost015.exe	89
PID 4528 wrote to memory of 5620	4528	svchost015.exe	91
PID 4528 wrote to memory of 2548	4528	svchost015.exe	93
PID 4528 wrote to memory of 1540	4528	svchost015.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\svchost015.exe
  C:\Users\Admin\AppData\Local\Temp\svchost015.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Roaming\HTEvm\sDyeB75Uf.exe
    "C:\Users\Admin\AppData\Roaming\HTEvm\sDyeB75Uf.exe"
    3⤵
    - Executes dropped EXE
    PID:1712
- - C:\Users\Admin\AppData\Roaming\zHpjy\RyLvV9ETP.exe
    "C:\Users\Admin\AppData\Roaming\zHpjy\RyLvV9ETP.exe"
    3⤵
    - Executes dropped EXE
    PID:5620
- - C:\Users\Admin\AppData\Roaming\szeYMaTL\q7FNdImHdZxC.exe
    "C:\Users\Admin\AppData\Roaming\szeYMaTL\q7FNdImHdZxC.exe"
    3⤵
    - Executes dropped EXE
    PID:2548
- - C:\Users\Admin\AppData\Roaming\L2RdTMT\YGed8o8vsws.exe
    "C:\Users\Admin\AppData\Roaming\L2RdTMT\YGed8o8vsws.exe"
    3⤵
    - Executes dropped EXE
    PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost015.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
Size 2.6MB
SHA256 4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71
MD5 ceeae1523c3864b719e820b75bf728aa
SHA1 cf607927b6ef864a11bf7ebbcdbb59891d23d320
SHA512 a06da3b96084040d49964b2227402ff1a2548ee5f1459df6b64bc6cbb271f19a00a798333e0f608d03c5a6de7355ae916309250204900117e3ef101f764d0f5f
SSDEEP 49152:OmI7Yi7hoaYCDuYX5417hQSCJV93mWADzh:/iVomD/pQhQYWuzh
TLSH
T172C59E60BBCAC1B2DA8B517A016EA71F5769EF84271055C3E3443E0ECD747D26E3A1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDyeB75Uf.exe

Path C:\Users\Admin\AppData\Roaming\HTEvm\sDyeB75Uf.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YGed8o8vsws.exe

Path C:\Users\Admin\AppData\Roaming\L2RdTMT\YGed8o8vsws.exe
Size 10KB
SHA256 aba14a64c2427ab54db44a605d5b408d57e713b3a4d26a226b657c3f9fb12928
MD5 4bd321ac2163c30f557e5afcd182748d
SHA1 9aaa9c8c49fa50c7a8cbf55ffda6fdce704fec6f
SHA512 fa15e6f384b28f81292642e7a2ea9bb2e698dd402407a3f35e3220ccd5b4d7b9b6e8e0932015a15d1f4943e5a6101b1e4715002ef0417c06447b00489336e8a6
SSDEEP 192:i6fTPULD5G7eEyzMlVnhfyGjcuXl0mRiZSJWXFa4n:i6fTMLD5G7WgVn8Gj5XlQMJ8g
TLSH
T10F221BC4A35561EAD54D033FC522CD23E596F10582A1EABF90B4D2B79F42B436A3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-24-0x00007FF6D4830000-0x00007FF6D483C000-memory.dmp

Download

memory/2548-34-0x00007FF7732C0000-0x00007FF7732CC000-memory.dmp

Download

memory/4440-0-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/4440-2-0x0000000000400000-0x0000000000754000-memory.dmp

Download

memory/4440-1-0x0000000000475000-0x0000000000476000-memory.dmp

Download

memory/4528-14-0x0000000000550000-0x000000000057F000-memory.dmp

Download

memory/4528-17-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/4528-8-0x0000000000550000-0x000000000057F000-memory.dmp

Download

memory/4528-40-0x0000000000550000-0x000000000057F000-memory.dmp

Download

memory/4528-42-0x0000000000550000-0x000000000057F000-memory.dmp

Download

memory/4528-50-0x0000000000550000-0x000000000057F000-memory.dmp

Download

memory/5620-29-0x00007FF641BB0000-0x00007FF641BBC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads