gcleaner | b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
Size

247KB
MD5

8ee1248b8e4ce46ce6d325d44e8d5675
SHA1

23fc155846d0598302f8e446a6a217fa867302bd
SHA256

b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb
SHA512

f12585d52dff357db8a70c590ee9a0d9d8f42833784984bdbccfa28bca2798ea31521b6c76a506c8194be8844424a455af3cabf2ff07239f7320adb360f3a93c
SSDEEP

3072:QhvQZELfgdofCaHCw2/Jt6fiJO5yg/m7YaWEU7SCtiCXHtycr62fi/o/BGy:QhQELfLf4JtK8y/mcaWEZC0CXHYcrpu

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3324	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
4820	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
1960	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
4804	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
2072	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
4232	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
4888	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
1544	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
4636	2120	WerFault.exe	b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe

C:\Users\Admin\AppData\Local\Temp\b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe
"C:\Users\Admin\AppData\Local\Temp\b57465b303a30f41e53c80907461317e8df654998b4562a84ffa894b5979c4eb.exe"
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 468
2⤵
- Program crash
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 500
2⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 780
2⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 820
2⤵
- Program crash
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 840
2⤵
- Program crash
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 852
2⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 984
2⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 988
2⤵
- Program crash
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1092
2⤵
- Program crash
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2120 -ip 2120
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2120 -ip 2120
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2120 -ip 2120
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2120 -ip 2120
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2120 -ip 2120
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2120 -ip 2120
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2120 -ip 2120
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2120-2-0x00000000021B0000-0x00000000021EC000-memory.dmp

Filesize
240KB

Download
memory/2120-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/2120-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2120-6-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/2120-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download