gcleaner | 28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
Size

396KB
MD5

8a21a59fc5ff1ca674a0ab50b7bc102c
SHA1

2858c55d923ae0273c5fd60aa30a4d64a71267af
SHA256

28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c
SHA512

a11e0285cd26de484bbcadc87c650d45ed003bd5deaba5485e9d1ada6213e6b8ba12b8e3d64877d6a5ef0b9a9f798fc45cb352931d26fc835a5c3aba90424138
SSDEEP

6144:uvLLMUbBN2tQ1W3q6Dh16gA92gm657HPWIVOa98kI/N3:IvMe6tQYDCBwgm60gOMiN

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2336	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
4580	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
900	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
832	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
4232	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
4936	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
800	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
1632	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
2856	4908	WerFault.exe	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe

pid process

4908 28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe

pid	process
4908	28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe

C:\Users\Admin\AppData\Local\Temp\28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe
"C:\Users\Admin\AppData\Local\Temp\28d85dc6226236f69b400bf94995744aac6d3fc45bb5fb29377a00ecee11b35c.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 408
2⤵
- Program crash
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 796
2⤵
- Program crash
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 804
2⤵
- Program crash
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 828
2⤵
- Program crash
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 888
2⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1000
2⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1104
2⤵
- Program crash
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1252
2⤵
- Program crash
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 820
2⤵
- Program crash
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4908 -ip 4908
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4908 -ip 4908
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4908 -ip 4908
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4908 -ip 4908
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4908 -ip 4908
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4908 -ip 4908
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4908 -ip 4908
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4908 -ip 4908
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4908 -ip 4908
1⤵
PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-2-0x0000000004480000-0x00000000044BC000-memory.dmp

Filesize
240KB

Download
memory/4908-1-0x0000000002890000-0x0000000002990000-memory.dmp

Filesize
1024KB

Download
memory/4908-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4908-4-0x0000000000400000-0x0000000002750000-memory.dmp

Filesize
35.3MB

Download
memory/4908-5-0x0000000002890000-0x0000000002990000-memory.dmp

Filesize
1024KB

Download
memory/4908-7-0x0000000004480000-0x00000000044BC000-memory.dmp

Filesize
240KB

Download
memory/4908-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download