gcleaner | 5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
Size

246KB
MD5

d9af65970b779b1ab9438022a342927b
SHA1

8e6c3f94b58c12f9360be85252e69ec1cc1fb358
SHA256

5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69
SHA512

1f4dbc10320bfe916b326442998b8ce39bee054b4f5b49c2e03b9d5e7a51be4a524f2af8ea1588591bebbab0314963c41a755a91066c08ca7a458ba2965d547a
SSDEEP

3072:gdrSjQ5c5vkC5aZ+zuvNKsaU6AQJuDX6V3M9tz2YjQBSb8zu0XgTfM1x:gcjQ8b5QlKswdUX19tzXGSb8v

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
388	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
696	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
1028	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
2408	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
1136	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
4196	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
3692	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
3804	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
1796	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
2864	2768	WerFault.exe	5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe

C:\Users\Admin\AppData\Local\Temp\5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe
"C:\Users\Admin\AppData\Local\Temp\5907c40a71c4ea5fc3d40e70015850fdd36ca7cb869c22d23467636b9a5b2b69.exe"
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 452
2⤵
- Program crash
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 452
2⤵
- Program crash
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 748
2⤵
- Program crash
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 788
2⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 808
2⤵
- Program crash
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 776
2⤵
- Program crash
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 912
2⤵
- Program crash
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 944
2⤵
- Program crash
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 1012
2⤵
- Program crash
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 752
2⤵
- Program crash
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2768 -ip 2768
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2768 -ip 2768
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2768 -ip 2768
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2768 -ip 2768
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2768 -ip 2768
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2768 -ip 2768
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2768 -ip 2768
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2768 -ip 2768
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2768 -ip 2768
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2768 -ip 2768
1⤵
PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

Filesize
1024KB

Download
memory/2768-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2768-2-0x0000000000610000-0x000000000064C000-memory.dmp

Filesize
240KB

Download
memory/2768-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2768-6-0x00000000006B0000-0x00000000007B0000-memory.dmp

Filesize
1024KB

Download
memory/2768-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download