gcleaner | aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
Size

399KB
MD5

1176eddcbf25be2d6f06c21b3b40b755
SHA1

23188a80c906942d357f8bb2660e9061e933786d
SHA256

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad
SHA512

eec48e24cd338731b8f5f5e1aebbf33ec3df8ff47db4994e4781580a9fc7462b70de7948b1c81876d6a34ab4f56cb3821a3784afde2a3005eef30f548b501ee3
SSDEEP

6144:DqLTSRU7j5Byw9oF0VYz5cti3LuQMTIWt:2/yU7j5bgNz2i3KQMT

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1420	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4788	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
1380	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4536	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
376	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4956	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2740	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2596	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4628	3580	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid process

3580 aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid	process
3580	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
"C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 536
2⤵
- Program crash
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 764
2⤵
- Program crash
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 804
2⤵
- Program crash
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 820
2⤵
- Program crash
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 864
2⤵
- Program crash
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 944
2⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 952
2⤵
- Program crash
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 1128
2⤵
- Program crash
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 768
2⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 3580
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3580 -ip 3580
1⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3580 -ip 3580
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3580 -ip 3580
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3580 -ip 3580
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3580 -ip 3580
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3580 -ip 3580
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3580 -ip 3580
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 3580
1⤵
PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3580-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3580-2-0x0000000003F80000-0x0000000003FBC000-memory.dmp

Filesize
240KB

Download
memory/3580-1-0x0000000002390000-0x0000000002490000-memory.dmp

Filesize
1024KB

Download
memory/3580-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/3580-5-0x0000000002390000-0x0000000002490000-memory.dmp

Filesize
1024KB

Download
memory/3580-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download