Analysis
- max time kernel
139s - max time network
140s - platform
windows7_x64 - resource
win7-en - submitted
08/09/2021, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
e0de7d9c7c293aa079e1bd411d8f2f95.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
- Target e0de7d9c7c293aa079e1bd411d8f2f95.exe
- Size 4.3MB
- Sample210908-d1xeaagger
- SHA256 c9c189dc56b69367c3c9249ca291824cd7486680d075dccdffec4c52af4d5d39
- MD5 e0de7d9c7c293aa079e1bd411d8f2f95
- SHA1 449d63503bd572d22926d17e85154e3e6fbc76f1
- SHA512 71b864d1f13f3c4c1d689c31ef1357591292c1d92347637faafb48423490bcdc953645f82a0e94fce219aa18d0cad4ad5faffb6f0e90714e17444504b64c9b57
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/single_exec
Signatures
- Glupteba Payload 3 IoCs
resource yara_rule behavioral1/memory/1632-52-0x0000000002BC0000-0x00000000034DE000-memory.dmp family_glupteba behavioral1/memory/1632-53-0x0000000000400000-0x0000000002575000-memory.dmp family_glupteba behavioral1/memory/932-54-0x0000000000400000-0x0000000002575000-memory.dmp family_glupteba - MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" e0de7d9c7c293aa079e1bd411d8f2f95.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1632 e0de7d9c7c293aa079e1bd411d8f2f95.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1632 e0de7d9c7c293aa079e1bd411d8f2f95.exe Token: SeImpersonatePrivilege 1632 e0de7d9c7c293aa079e1bd411d8f2f95.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0de7d9c7c293aa079e1bd411d8f2f95.exe"C:\Users\Admin\AppData\Local\Temp\e0de7d9c7c293aa079e1bd411d8f2f95.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\e0de7d9c7c293aa079e1bd411d8f2f95.exe"C:\Users\Admin\AppData\Local\Temp\e0de7d9c7c293aa079e1bd411d8f2f95.exe"2⤵
- Modifies data under HKEY_USERS
PID:932
-