| File name: | ra02W4S.exe |
| Full analysis: | https://app.any.run/tasks/b4d71fa4-aa87-4ecb-a682-e4e494ee1e7c |
| Verdict: | Malicious activity |
| Threats: | GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools |
| Analysis date: | May 10, 2025, 06:24:02 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | B31CB70FB3A9A5978F70ECE692A9F006 |
| SHA1: | DBB9E95468306F32F31BAA90589E4128E4C24962 |
| SHA256: | E596BEA77A032D4D8887EB905DB0ECFC3B5BB4B90B70913DCBB19FBAF909B7B5 |
| SSDEEP: | 98304:be3m5fNgME+YXs/JxDMXEB1KXWUNVRV6g3mlVgIL2XNmxfzR7Xl:Z |
MALICIOUS
Executing a file with an untrusted certificate
- ra02W4S.exe (PID: 2088)
GCLEANER has been detected (SURICATA)
- ra02W4S.exe (PID: 2088)
Steals credentials from Web Browsers
- 45PRJLxwQ7Ssz.exe (PID: 1012)
LUMMA mutex has been found
- 45PRJLxwQ7Ssz.exe (PID: 1012)
Actions looks like stealing of personal data
- 45PRJLxwQ7Ssz.exe (PID: 1012)
SUSPICIOUS
Reads security settings of Internet Explorer
- ra02W4S.exe (PID: 2088)
- ramdriveplugin33.exe (PID: 1056)
Executable content was dropped or overwritten
- RQSuasSkqSK.exe (PID: 6436)
- ra02W4S.exe (PID: 2088)
- RQSuasSkqSK.tmp (PID: 5452)
- ramdriveplugin33.exe (PID: 1056)
Reads the Windows owner or organization settings
- RQSuasSkqSK.tmp (PID: 5452)
The process drops C-runtime libraries
- RQSuasSkqSK.tmp (PID: 5452)
Process drops legitimate windows executable
- RQSuasSkqSK.tmp (PID: 5452)
Starts POWERSHELL.EXE for commands execution
- ramdriveplugin33.exe (PID: 1056)
Connects to the server without a host name
- ra02W4S.exe (PID: 2088)
Searches for installed software
- 45PRJLxwQ7Ssz.exe (PID: 1012)
Potential Corporate Privacy Violation
- ra02W4S.exe (PID: 2088)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- 45PRJLxwQ7Ssz.exe (PID: 1012)
INFO
The sample compiled with english language support
- ra02W4S.exe (PID: 2088)
- RQSuasSkqSK.tmp (PID: 5452)
Checks supported languages
- ra02W4S.exe (PID: 2088)
- RQSuasSkqSK.exe (PID: 6436)
- RQSuasSkqSK.tmp (PID: 5452)
- ramdriveplugin33.exe (PID: 1056)
- 45PRJLxwQ7Ssz.exe (PID: 1012)
- Gz172gOQT.exe (PID: 736)
- O3sQrxgsIYa.exe (PID: 5556)
- RAMDrivePlugin.exe (PID: 3332)
Reads the computer name
- ra02W4S.exe (PID: 2088)
- RQSuasSkqSK.tmp (PID: 5452)
- ramdriveplugin33.exe (PID: 1056)
- O3sQrxgsIYa.exe (PID: 5556)
- Gz172gOQT.exe (PID: 736)
- RAMDrivePlugin.exe (PID: 3332)
- 45PRJLxwQ7Ssz.exe (PID: 1012)
Checks proxy server information
- ra02W4S.exe (PID: 2088)
- slui.exe (PID: 1324)
Reads the machine GUID from the registry
- ra02W4S.exe (PID: 2088)
Creates files or folders in the user directory
- RQSuasSkqSK.tmp (PID: 5452)
- ra02W4S.exe (PID: 2088)
Create files in a temporary directory
- RQSuasSkqSK.tmp (PID: 5452)
- RQSuasSkqSK.exe (PID: 6436)
Creates a software uninstall entry
- RQSuasSkqSK.tmp (PID: 5452)
Creates files in the program directory
- ramdriveplugin33.exe (PID: 1056)
Process checks computer location settings
- ramdriveplugin33.exe (PID: 1056)
Changes the registry key values via Powershell
- ramdriveplugin33.exe (PID: 1056)
Manual execution by a user
- RAMDrivePlugin.exe (PID: 3332)
Detects InnoSetup installer (YARA)
- RQSuasSkqSK.tmp (PID: 5452)
- RQSuasSkqSK.exe (PID: 6436)
Compiled with Borland Delphi (YARA)
- RQSuasSkqSK.tmp (PID: 5452)
Reads the software policy settings
- 45PRJLxwQ7Ssz.exe (PID: 1012)
- ra02W4S.exe (PID: 2088)
Attempting to use instant messaging service
- 45PRJLxwQ7Ssz.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | InstallShield setup (42.5) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (27.2) |
| .cpl | | | Win 9x/ME Control Panel applet (15.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.4) |
| .exe | | | Win32 Executable (generic) (4.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:02:09 08:48:01+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 1854976 |
| InitializedDataSize: | 567296 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x18c4f2 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.1845 |
| ProductVersionNumber: | 1.0.0.1845 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Qihoo 360 Technology Co. Ltd. |
| FileVersion: | 1, 0, 0, 1845 |
| InternalName: | SoftMgrLite.exe |
| LegalCopyright: | (C) Qihoo 360 Technology Co. Ltd., All rights reserved. |
| OriginalFileName: | SoftMgrLite.exe |
| ProductName: | 360 Total Security |
| ProductVersion: | 1, 0, 0, 1845 |
Total processes
142
Monitored processes
11
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 736 | "C:\Users\admin\AppData\Roaming\raQuUaD2Upy\Gz172gOQT.exe" | C:\Users\admin\AppData\Roaming\raQuUaD2Upy\Gz172gOQT.exe | — | ra02W4S.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Gcleanerapp Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 812 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ramDriveP" -Value "C:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exe" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | ramdriveplugin33.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1012 | "C:\Users\admin\AppData\Roaming\sJIonvnT0\45PRJLxwQ7Ssz.exe" | C:\Users\admin\AppData\Roaming\sJIonvnT0\45PRJLxwQ7Ssz.exe | ra02W4S.exe | ||||||||||||
User: admin Company: Automated Workflow LLC Integrity Level: MEDIUM Description: Application for Prototype Element Version: 3.9.692.2529 Modules
| |||||||||||||||
| 1056 | "C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\ramdriveplugin33.exe" -i | C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\ramdriveplugin33.exe | RQSuasSkqSK.tmp | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 0.1.3.3 Modules
| |||||||||||||||
| 1324 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2088 | "C:\Users\admin\AppData\Local\Temp\ra02W4S.exe" | C:\Users\admin\AppData\Local\Temp\ra02W4S.exe | explorer.exe | ||||||||||||
User: admin Company: Qihoo 360 Technology Co. Ltd. Integrity Level: MEDIUM Exit code: 0 Version: 1, 0, 0, 1845 Modules
| |||||||||||||||
| 3332 | C:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exe | C:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Version: 0.1.3.3 Modules
| |||||||||||||||
| 5384 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5452 | "C:\Users\admin\AppData\Local\Temp\is-LJTI2.tmp\RQSuasSkqSK.tmp" /SL5="$5027C,3729689,54272,C:\Users\admin\AppData\Roaming\RP1UrV\RQSuasSkqSK.exe" | C:\Users\admin\AppData\Local\Temp\is-LJTI2.tmp\RQSuasSkqSK.tmp | RQSuasSkqSK.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Version: 51.52.0.0 Modules
| |||||||||||||||
| 5556 | "C:\Users\admin\AppData\Roaming\d8SR6I4\O3sQrxgsIYa.exe" | C:\Users\admin\AppData\Roaming\d8SR6I4\O3sQrxgsIYa.exe | — | ra02W4S.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Gcleanerapp Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
6 340
Read events
6 323
Write events
17
Delete events
0
Modification events
| (PID) Process: | (2088) ra02W4S.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2088) ra02W4S.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2088) ra02W4S.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\unins000.exe" | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\unins000.exe" /SILENT | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | NoRepair |
Value: 1 | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | InstallDate |
Value: 20250510 | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | EstimatedSize |
Value: 8858 | |||
| (PID) Process: | (5452) RQSuasSkqSK.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.5.0 (a) | |||
Executable files
35
Suspicious files
14
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\is-91UEQ.tmp | executable | |
MD5:813388575E22C75E1813B17935265DED | SHA256:A6313E14A84AFA0C75E69CB568DD9DC9CE779026AE9BD8970887D5F77640E9D6 | |||
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\Temp\is-2APT9.tmp\_isetup\_setup64.tmp | executable | |
MD5:4FF75F505FDDCC6A9AE62216446205D9 | SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81 | |||
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\is-VH4U2.tmp | executable | |
MD5:DAE4100039A943128C34BA3E05F6CD02 | SHA256:2357806CA24C9D3152D54D34270810DA9D9CA943462EBF7291AE06A10E5CB8BA | |||
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\unins000.exe | executable | |
MD5:813388575E22C75E1813B17935265DED | SHA256:A6313E14A84AFA0C75E69CB568DD9DC9CE779026AE9BD8970887D5F77640E9D6 | |||
| 2088 | ra02W4S.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\fuckingdllENCR[1].dll | binary | |
MD5:4BC1EF6688690AF3DD8D3D70906A9F98 | SHA256:6BBFC32B36972B252587914130FF5018E20B4327D28A4AE6DB06395B80ACA4CE | |||
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\icuuc51.dll | executable | |
MD5:DAE4100039A943128C34BA3E05F6CD02 | SHA256:2357806CA24C9D3152D54D34270810DA9D9CA943462EBF7291AE06A10E5CB8BA | |||
| 2088 | ra02W4S.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\ONE[1].file | executable | |
MD5:1433B58DEA2215937FDC538A84A147C5 | SHA256:7764AD7E5BE0297986D47450F154453515D5C557B620CD6E0FA505AFDACCF87D | |||
| 2088 | ra02W4S.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C60C0C29522E01E6A22BD2717F20782E_BB79CA8C6D209B802D43900E1F55F992 | binary | |
MD5:DA610A6AC5816CD744265B93836B6D0C | SHA256:A376DCB97DD315AD1302C6D80E03CA9D4AC8C8B9764FC03A58E6A4F0E1080E42 | |||
| 2088 | ra02W4S.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\info[1].htm | text | |
MD5:FE9B08252F126DDFCB87FB82F9CC7677 | SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF | |||
| 5452 | RQSuasSkqSK.tmp | C:\Users\admin\AppData\Local\Temp\is-2APT9.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
32
DNS requests
19
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2088 | ra02W4S.exe | GET | 200 | 172.217.16.195:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
2088 | ra02W4S.exe | GET | 200 | 185.156.72.196:80 | http://185.156.72.196/success?substr=mixtwelve&s=three&sub=none | unknown | — | — | malicious |
2088 | ra02W4S.exe | GET | 200 | 142.250.185.99:80 | http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D | unknown | — | — | whitelisted |
2088 | ra02W4S.exe | GET | 200 | 172.217.16.195:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
2088 | ra02W4S.exe | GET | 200 | 185.156.72.196:80 | http://185.156.72.196/service | unknown | — | — | malicious |
2088 | ra02W4S.exe | GET | 200 | 185.156.72.196:80 | http://185.156.72.196/service | unknown | — | — | malicious |
2088 | ra02W4S.exe | GET | 200 | 185.156.72.196:80 | http://185.156.72.196/service | unknown | — | — | malicious |
2088 | ra02W4S.exe | GET | 200 | 185.156.72.196:80 | http://185.156.72.196/service | unknown | — | — | malicious |
5496 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5176 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.112:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.130:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
drive.usercontent.google.com |
| whitelisted |
c.pki.goog |
| whitelisted |
o.pki.goog |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |
— | — | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
— | — | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |
— | — | A Network Trojan was detected | LOADER [ANY.RUN] GCleaner HTTP Header |