Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 Infrastructure – Resilient & Redundant Servers

Process Hacker memory analysis reveals a comprehensive list of domains used by Dropper GCleaner for C2 communication. These domains are hosted on various platforms (Scaleway, Render, Replit, etc.), indicating a robust and redundant infrastructure.

Key Observations:

• Hosting Providers: Scaleway (scw.cloud), Render (onrender.com), Replit (repl.co), and others.
• Domains: readthedocs.io, rhcloud.com, app.render.com, id.repl.co, resindevice.io, etc.
• Purpose: Likely used for payload delivery, data exfiltration, or command execution.

Why This Matters:

• Resilience: Multiple domains ensure the malware remains operational even if some are blocked.
• Evasion: The use of legitimate hosting providers helps avoid detection.
• Redundancy: Backup domains ensure continuous C2 communication.

Visual Reference:

Process Hacker view showing the extensive list of C2 domains used by Dropper GCleaner.

2. PowerShell & Conhost Process Strings

Process Hacker memory analysis of the PowerShell process reveals that Dropper GCleaner uses conhost.exe and powershell.exe for execution. The strings show critical Windows API calls used for clipboard manipulation and window management.

Key Functions Observed:

• NtUserGetClipboardData – Reads data from the clipboard.
• SetClipboardData – Writes data to the clipboard.
• NtUserRegisterHotKey – Registers global hotkeys.
• NtUserSwitchDesktop – Switches the desktop (potential evasion).
• NtUserSetWindowLongPtr – Modifies window properties.
• NtReadVirtualMemory – Reads memory from other processes.
• NtCreateFile – Creates or opens files.

Why This Matters:

• Clipboard Stealing: The malware can steal copied text (passwords, crypto addresses).
• Evasion: NtUserSwitchDesktop can be used to hide malicious windows.
• Persistence: Hotkeys can be used to trigger malicious actions.

Visual Reference:

Process Hacker view showing PowerShell process strings with NtUserGetClipboardData, SetClipboardData, and other APIs.

3. Kernel Driver & Privilege Escalation

Further analysis of PowerShell process strings reveals that Dropper GCleaner has advanced system-level capabilities, including kernel driver loading and privilege escalation.

Key Functions Observed:

• NtLoadDriver – Loads a kernel driver.
• NtAdjustPrivilegesToken – Adjusts token privileges for escalation.
• NtSetSystemInformation – Modifies system information (potential evasion).
• NtTerminateProcess – Terminates processes (e.g., security tools).
• CoCreateInstance – Creates COM objects for system interaction.
• RegOpenKeyExW – Opens registry keys for persistence.

Why This Matters:

• Kernel Access: NtLoadDriver allows the malware to load drivers, giving it deep system access.
• Privilege Escalation: NtAdjustPrivilegesToken enables the malware to gain higher privileges.
• Evasion: NtSetSystemInformation can be used to hide from security tools.

Visual Reference:

Process Hacker view showing PowerShell strings with NtLoadDriver, NtAdjustPrivilegesToken, and NtSetSystemInformation.

4. Kernel & System Control – Conhost Strings

Analysis of conhost process strings reveals that Dropper GCleaner has advanced kernel-level capabilities, including driver loading, system shutdown, and debug control.

Key Functions Observed:

• NtLoadDriver – Loads a kernel driver.
• NtShutdownSystem – Shuts down or reboots the system.
• NtSystemDebugControl – Performs system debug operations.
• NtCreateThread – Creates threads in other processes.
• NtTerminateProcess – Terminates processes (e.g., security tools).
• NtSetSystemInformation – Modifies system information.
• NtCreateSection – Creates memory sections (for code injection).

Why This Matters:

• System Control: NtShutdownSystem allows the malware to disrupt the system.
• Kernel Access: NtLoadDriver and NtSystemDebugControl give deep system access.
• Injection: NtCreateSection and NtCreateThread are used for code injection.

Visual Reference:

Process Hacker view showing conhost strings with NtLoadDriver, NtShutdownSystem, and NtSystemDebugControl.

5. .rdata Payload – Full API List

Binary Ninja analysis of the .rdata section reveals the complete payload of Dropper GCleaner . The API list confirms its capabilities as a full-featured info-stealer and system manipulator.

Key API Categories:

• Token & Privilege Management: GetTokenInformation, AdjustTokenPrivileges, OpenProcessToken
• Registry Operations: RegOpenKeyExA, RegSetValueExA, RegDeleteValueA, RegCreateKeyExA
• File & Directory Operations: CreateFileA, DeleteFileA, FindFirstFileA, SetFileAttributesA
• Process & Thread Management: CreateThread, TerminateThread, GetCurrentProcess

Why This Matters:

• Data Theft: APIs cover token, registry, and file operations.
• Persistence: Registry and file operations allow the malware to maintain control.
• Evasion: Token manipulation and privilege escalation help avoid detection.

Visual Reference:

Binary Ninja view showing the full list of Windows APIs from the .rdata section.

Conclusion

This analysis uncovered **Dropper GCleaner **, a sophisticated malware that combines a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost execution, and a rich .rdata payload.

Key Takeaways:

• C2 Infrastructure: 30+ domains (readthedocs.io, scw.cloud, onrender.com, etc.) for resilient communication.
• Kernel Driver: NtLoadDriver for deep system access.
• PowerShell/Conhost: Executes via both powershell.exe and conhost.exe for stealth.
• .rdata Payload: Full API list extracted from .rdata section (token manipulation, registry ops, file management).
• Advanced Evasion: Uses NtAdjustPrivilegesToken, NtSetSystemInformation, and NtSystemDebugControl.

Detection Recommendations:

• Block the identified C2 domains (see full list in the analysis).
• Monitor for NtLoadDriver and NtAdjustPrivilegesToken calls.
• Detect PowerShell and Conhost processes with suspicious command lines.
• Monitor .rdata sections for large API lists.

Sample Download

The analyzed Dropper GCleaner sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 Dropper GCleaner Sample on MalwareBazaar

Tools Used: Process Hacker, Binary Ninja, x64dbg