gcleaner | aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad

Analysis

max time kernel
141s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27-06-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
Size

399KB
MD5

1176eddcbf25be2d6f06c21b3b40b755
SHA1

23188a80c906942d357f8bb2660e9061e933786d
SHA256

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad
SHA512

eec48e24cd338731b8f5f5e1aebbf33ec3df8ff47db4994e4781580a9fc7462b70de7948b1c81876d6a34ab4f56cb3821a3784afde2a3005eef30f548b501ee3
SSDEEP

6144:DqLTSRU7j5Byw9oF0VYz5cti3LuQMTIWt:2/yU7j5bgNz2i3KQMT

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
436	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
3588	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
3152	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
1576	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2748	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2432	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2936	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4004	4876	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid process

4876 aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid	process
4876	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
"C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 524
2⤵
- Program crash
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 796
2⤵
- Program crash
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 840
2⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 860
2⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 896
2⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1000
2⤵
- Program crash
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1088
2⤵
- Program crash
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 800
2⤵
- Program crash
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4876 -ip 4876
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4876 -ip 4876
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4876 -ip 4876
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4876 -ip 4876
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4876 -ip 4876
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4876 -ip 4876
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4876 -ip 4876
1⤵
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-1-0x00000000024A0000-0x00000000025A0000-memory.dmp

Filesize
1024KB

Download
memory/4876-2-0x0000000004090000-0x00000000040CC000-memory.dmp

Filesize
240KB

Download
memory/4876-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/4876-5-0x00000000024A0000-0x00000000025A0000-memory.dmp

Filesize
1024KB

Download
memory/4876-7-0x0000000004090000-0x00000000040CC000-memory.dmp

Filesize
240KB

Download
memory/4876-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download