gcleaner | 699dce6dc57a0b634d71449eff829d793a198e7241d30614e7868fe157ce1510

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 851KB
Sample261004-jfxgfasfne
SHA256 699dce6dc57a0b634d71449eff829d793a198e7241d30614e7868fe157ce1510
MD5 58696653f9cf242daecba907e04c6bf6
SHA1 bcd031754838db241f8f3840ef736257b0585f7b
SHA512 e1db7d3e182e14d2a986102af80aabf2bae43535c402789198e5602de51f866f1e7a5c4b538b45cf34ef449c0e7bfc222bc7714abcf0779a1465ac8d3bd19382
SSDEEP 24576:PMVlppY8rMGSYf4r1lSfrFX0glLL9E17HHsPNh:PMVHKjsZfRLS17HHsPNh
TLSH
T1FC059E22A3E34837D0B22ABD4C1B56649B267F432937D9462BF42B483F353593726397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gcleaner loader privilege_escalation

Malware Config

Extracted

Family

gcleaner

185.156.73.98

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5836 created 3236	5836	file.exe	80

Downloads MZ/PE file 2 IoCs

flow	pid	Process
11	3800	svchost.exe
11	3800	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5836 set thread context of 3800	5836	file.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	file.exe
5836	file.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88
PID 5836 wrote to memory of 3800	5836	file.exe	88

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3236
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5836
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

service[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\service[1].htm
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

YCL.exe

Path C:\Users\Admin\AppData\Local\Temp\BY8f57861tf32D1Zw09tdfVe\YCL.exe
Size 2.5MB
SHA256 8362802ae1052f7e5c5aa1d24009badb5f9a18c562436b3ff2d923d6cd4a9da6
MD5 7c41897c403dd53321727e34d88f71ad
SHA1 06429fe678edcdbb25ee1951e61df08c0f68294a
SHA512 874bc6f7e8711c51b84a6ca033c12f6e19f6b6ab165ad2d6ed342f3fe31fd88f2f712d807a56faff7d70d3b478bb443ccfe902c770a933d8614e5b2135b090f6
SSDEEP 49152:98RPXkAT8C0FJ0vaFd1maSoT+xh12tUuU8X:9pi8Ian1lT+xh12t
TLSH
T147C52807D3F681D8F1FBE730CAB662735C72BC195638A59D1685DA251E30E708F29B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-7-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-12-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-50-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-5-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/3800-6-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-8-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-10-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-9-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-29-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/3800-13-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-17-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-16-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-15-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/3800-14-0x0000000000A20000-0x0000000000A53000-memory.dmp

Download

memory/5836-3-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/5836-0-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/5836-2-0x00000000022E0000-0x00000000022E1000-memory.dmp

Download

memory/5836-1-0x0000000000489000-0x000000000048A000-memory.dmp

Download

memory/5836-4-0x00000000023A0000-0x00000000023CF000-memory.dmp

Download