gcleaner | ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
Size

332KB
MD5

b1e62fb0c2fbd63e14bbc0dbb8c759a8
SHA1

4c79383307a81ceb0d65377ee61862682cc579c7
SHA256

ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb
SHA512

e773f435f855147bf393a218ba2c0a1f5a806c8617c01c1d77addacede216702af33c9c16933fd6d942bd04380c5f0fd693797ec373449c06b607511a98daeee
SSDEEP

6144:3LYcF4qRjE9UP+PYUAJalV2QwFz0ZtQaXvarj:30cqYUAUlV2QwFz0Zt3Xyr

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

185.172.128.69

Attributes

url_path
/advdlc.php

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4976	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
1488	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
1256	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
4028	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
3872	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
3704	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
5048	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
3732	4768	WerFault.exe	ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe

C:\Users\Admin\AppData\Local\Temp\ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe
"C:\Users\Admin\AppData\Local\Temp\ef0b1d3c1b17e4b700f4ee78a2a078063a87ee01e23778e557f036ab2c80feeb.exe"
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 744
2⤵
- Program crash
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 784
2⤵
- Program crash
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 744
2⤵
- Program crash
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 816
2⤵
- Program crash
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 904
2⤵
- Program crash
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 980
2⤵
- Program crash
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 916
2⤵
- Program crash
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 748
2⤵
- Program crash
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4768 -ip 4768
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4768 -ip 4768
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4768 -ip 4768
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4768 -ip 4768
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4768 -ip 4768
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4768 -ip 4768
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4768 -ip 4768
1⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4248,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4768 -ip 4768
1⤵
PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-1-0x0000000002520000-0x0000000002620000-memory.dmp

Filesize
1024KB

Download
memory/4768-2-0x00000000024F0000-0x000000000251D000-memory.dmp

Filesize
180KB

Download
memory/4768-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4768-4-0x0000000000400000-0x000000000236F000-memory.dmp

Filesize
31.4MB

Download
memory/4768-5-0x0000000002520000-0x0000000002620000-memory.dmp

Filesize
1024KB

Download
memory/4768-7-0x00000000024F0000-0x000000000251D000-memory.dmp

Filesize
180KB

Download