Overview

overview

10

Static

static

22adb7035a...4f.exe

windows7_x64

10

22adb7035a...4f.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f.exe

  • Size

    3.8MB

  • MD5

    528b632a2846b97d1d6bc9756445a6d2

  • SHA1

    a68b1b48327ea370288a3c8e70f720b227814d4b

  • SHA256

    22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f

  • SHA512

    6da07734df2bb392a48bae53fbeec2519a1b62bf5e35ec49543fb7d8e9e3e26bbdf8169531dd9217a8c1958890aa3e865002fbca1f78b94e994ac3ca3a8bfb6f

Score
10/10
gluptebadropperevasionloaderpersistencetrojan

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 4 IoCs
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 12 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f.exe
    "C:\Users\Admin\AppData\Local\Temp\22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f.exe
      "C:\Users\Admin\AppData\Local\Temp\22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f.exe"
      2⤵
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies data under HKEY_USERS
          PID:1872
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1972
  • C:\Windows\system32\makecab.exe
    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220201075722.log C:\Windows\Logs\CBS\CbsPersist_20220201075722.cab
    1⤵
    • Drops file in Windows directory
    PID:1004

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1124-58-0x0000000002830000-0x0000000002BD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/1124-60-0x0000000000400000-0x0000000000E81000-memory.dmp

    Filesize

    10.5MB

    Download

  • memory/1292-54-0x0000000002770000-0x0000000002B14000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/1292-55-0x0000000002B20000-0x000000000320F000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1292-56-0x0000000000400000-0x0000000000E81000-memory.dmp

    Filesize

    10.5MB

    Download

  • memory/1872-61-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1972-65-0x0000000002850000-0x0000000002BF4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/1972-67-0x0000000000400000-0x0000000000E81000-memory.dmp

    Filesize

    10.5MB

    Download