gcleaner | 5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe
Size 1.1MB
Sample261107-gqqerseb45
SHA256 5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9
MD5 d51b75c305cc4973d2e01fcdccdb0939
SHA1 0945c3389051b0e611ccb02c9c3f95ffc51053fb
SHA512 b82d1f7adaf8060bc3feede871e99112ebf08f08ad0f98f771033ad374f7050e0064b2ceb10fec9892cead3ee603ecc78255e7323e204e668951c5055d08c159
SSDEEP 24576:h0Qx7HwX7mGrp9vajbcqALziBDEfEcbOmS6nh/FaD0J9c:Oo0C8rmAHd5bOtqh9kr
TLSH
T15E357D22B291D83BC273067CDE5BA2A998757D105D2CA44F7EE84F4C1E35A813F391A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gcleaner loader privilege_escalation

Malware Config

Extracted

Family

gcleaner

185.156.73.98

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3792 created 3564	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	81

Downloads MZ/PE file 14 IoCs

flow	pid	Process
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
7	1224	svchost.exe
9	1224	svchost.exe

Executes dropped EXE 13 IoCs

pid	Process
3124	HlLOx9S6tRPF6.exe
2376	OLQxyoDuQGHy.exe
4532	XXlwn7P5w87.exe
5968	reDA5qfNcil.exe
1232	zuDi9iSrZ.exe
5268	b8K9vkm8tQU.exe
5884	fpbQ23uRrrs.exe
1728	0dG888vt6Pm.exe
3036	RRXPieYuZs.exe
2504	gT7inN9qEgv.exe
572	nqrX9MEkK7.exe
5796	jqhasAslI.exe
2796	rtRn865s8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe
3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 3792 wrote to memory of 1224	3792	5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe	89
PID 1224 wrote to memory of 3124	1224	svchost.exe	91
PID 1224 wrote to memory of 2376	1224	svchost.exe	93
PID 1224 wrote to memory of 4532	1224	svchost.exe	95
PID 1224 wrote to memory of 5968	1224	svchost.exe	97
PID 1224 wrote to memory of 1232	1224	svchost.exe	99
PID 1224 wrote to memory of 5268	1224	svchost.exe	102
PID 1224 wrote to memory of 5884	1224	svchost.exe	104
PID 1224 wrote to memory of 1728	1224	svchost.exe	106
PID 1224 wrote to memory of 3036	1224	svchost.exe	108
PID 1224 wrote to memory of 2504	1224	svchost.exe	110
PID 1224 wrote to memory of 572	1224	svchost.exe	112
PID 1224 wrote to memory of 5796	1224	svchost.exe	114
PID 1224 wrote to memory of 2796	1224	svchost.exe	116

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3564
- C:\Users\Admin\AppData\Local\Temp\5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe
  "C:\Users\Admin\AppData\Local\Temp\5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3792
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Roaming\ccVTswqRuEI\HlLOx9S6tRPF6.exe
    "C:\Users\Admin\AppData\Roaming\ccVTswqRuEI\HlLOx9S6tRPF6.exe"
    3⤵
    - Executes dropped EXE
    PID:3124
- - C:\Users\Admin\AppData\Roaming\Mrr56QSpJr2\OLQxyoDuQGHy.exe
    "C:\Users\Admin\AppData\Roaming\Mrr56QSpJr2\OLQxyoDuQGHy.exe"
    3⤵
    - Executes dropped EXE
    PID:2376
- - C:\Users\Admin\AppData\Roaming\8hrW42\XXlwn7P5w87.exe
    "C:\Users\Admin\AppData\Roaming\8hrW42\XXlwn7P5w87.exe"
    3⤵
    - Executes dropped EXE
    PID:4532
- - C:\Users\Admin\AppData\Roaming\wRnb8f\reDA5qfNcil.exe
    "C:\Users\Admin\AppData\Roaming\wRnb8f\reDA5qfNcil.exe"
    3⤵
    - Executes dropped EXE
    PID:5968
- - C:\Users\Admin\AppData\Roaming\TZftQ\zuDi9iSrZ.exe
    "C:\Users\Admin\AppData\Roaming\TZftQ\zuDi9iSrZ.exe"
    3⤵
    - Executes dropped EXE
    PID:1232
- - C:\Users\Admin\AppData\Roaming\jKK77\b8K9vkm8tQU.exe
    "C:\Users\Admin\AppData\Roaming\jKK77\b8K9vkm8tQU.exe"
    3⤵
    - Executes dropped EXE
    PID:5268
- - C:\Users\Admin\AppData\Roaming\heSAEsM6EFG\fpbQ23uRrrs.exe
    "C:\Users\Admin\AppData\Roaming\heSAEsM6EFG\fpbQ23uRrrs.exe"
    3⤵
    - Executes dropped EXE
    PID:5884
- - C:\Users\Admin\AppData\Roaming\IuLgtKz9zAP\0dG888vt6Pm.exe
    "C:\Users\Admin\AppData\Roaming\IuLgtKz9zAP\0dG888vt6Pm.exe"
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Users\Admin\AppData\Roaming\Gwo97sbDSfC\RRXPieYuZs.exe
    "C:\Users\Admin\AppData\Roaming\Gwo97sbDSfC\RRXPieYuZs.exe"
    3⤵
    - Executes dropped EXE
    PID:3036
- - C:\Users\Admin\AppData\Roaming\Sv65s6Ry28\gT7inN9qEgv.exe
    "C:\Users\Admin\AppData\Roaming\Sv65s6Ry28\gT7inN9qEgv.exe"
    3⤵
    - Executes dropped EXE
    PID:2504
- - C:\Users\Admin\AppData\Roaming\V6lW9D\nqrX9MEkK7.exe
    "C:\Users\Admin\AppData\Roaming\V6lW9D\nqrX9MEkK7.exe"
    3⤵
    - Executes dropped EXE
    PID:572
- - C:\Users\Admin\AppData\Roaming\ppdJQ\jqhasAslI.exe
    "C:\Users\Admin\AppData\Roaming\ppdJQ\jqhasAslI.exe"
    3⤵
    - Executes dropped EXE
    PID:5796
- - C:\Users\Admin\AppData\Roaming\egPt8\rtRn865s8.exe
    "C:\Users\Admin\AppData\Roaming\egPt8\rtRn865s8.exe"
    3⤵
    - Executes dropped EXE
    PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HlLOx9S6tRPF6.exe

Path C:\Users\Admin\AppData\Roaming\ccVTswqRuEI\HlLOx9S6tRPF6.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-103-0x00007FF63A200000-0x00007FF63A20C000-memory.dmp

Download

memory/1224-16-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-6-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-120-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-12-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-11-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-9-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-8-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-7-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-35-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/1224-5-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/1224-15-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-20-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-18-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-17-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1224-19-0x0000000000490000-0x00000000004C3000-memory.dmp

Download

memory/1232-67-0x00007FF743080000-0x00007FF74308C000-memory.dmp

Download

memory/1728-85-0x00007FF6666F0000-0x00007FF6666FC000-memory.dmp

Download

memory/2376-49-0x00007FF745430000-0x00007FF74543C000-memory.dmp

Download

memory/2504-97-0x00007FF7343C0000-0x00007FF7343CC000-memory.dmp

Download

memory/2796-115-0x00007FF72E2E0000-0x00007FF72E2EC000-memory.dmp

Download

memory/3036-91-0x00007FF708A00000-0x00007FF708A0C000-memory.dmp

Download

memory/3124-43-0x00007FF64E310000-0x00007FF64E31C000-memory.dmp

Download

memory/3792-3-0x0000000000400000-0x000000000051C000-memory.dmp

Download

memory/3792-2-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3792-4-0x00000000024C0000-0x00000000024EF000-memory.dmp

Download

memory/3792-1-0x00000000004CE000-0x00000000004CF000-memory.dmp

Download

memory/3792-0-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/4532-55-0x00007FF709740000-0x00007FF70974C000-memory.dmp

Download

memory/5268-73-0x00007FF6BF4E0000-0x00007FF6BF4EC000-memory.dmp

Download

memory/5796-109-0x00007FF7DB9B0000-0x00007FF7DB9BC000-memory.dmp

Download

memory/5884-79-0x00007FF6B0CC0000-0x00007FF6B0CCC000-memory.dmp

Download

memory/5968-61-0x00007FF71AC00000-0x00007FF71AC0C000-memory.dmp

Download