gcleaner | 8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
Size

246KB
MD5

287fb827b00bf73f50f8ccc07543d53f
SHA1

79e561af9a62f13081613ac9cbc1d49b63dac9c3
SHA256

8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa
SHA512

b949f478958bed777d4de957091dc992a09c7e7e1d560c23c6e2ea9b49162e085b920c38ed33828e753d25d41728fb9125691865582e43397d274aec2c06df8f
SSDEEP

3072:ohvQZELfgN7yzB+lUScQTqJs8Ts0aiWnBbgxFamFre823kh9Ko/KN:ohQELfpzB+WSJpBvZg6mFrex3G9K

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2560	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
1424	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
3116	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
2972	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
3600	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
220	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
4584	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
804	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
688	4888	WerFault.exe	8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe

C:\Users\Admin\AppData\Local\Temp\8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe
"C:\Users\Admin\AppData\Local\Temp\8fa853a4317364c26df409c70b32b37f145bbefc01ca397c2c20504d379a6bfa.exe"
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 476
2⤵
- Program crash
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 500
2⤵
- Program crash
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 780
2⤵
- Program crash
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 820
2⤵
- Program crash
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 860
2⤵
- Program crash
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 908
2⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 804
2⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 812
2⤵
- Program crash
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 784
2⤵
- Program crash
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4888 -ip 4888
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4888 -ip 4888
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4888 -ip 4888
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4888 -ip 4888
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4888 -ip 4888
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4888 -ip 4888
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4888 -ip 4888
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888
1⤵
PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-1-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/4888-2-0x0000000002150000-0x000000000218C000-memory.dmp

Filesize
240KB

Download
memory/4888-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4888-6-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/4888-7-0x0000000002150000-0x000000000218C000-memory.dmp

Filesize
240KB

Download
memory/4888-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download