General
-
Target
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
-
Size
3.9MB
-
Sample
220520-2ac5qafaa4
-
MD5
c40e14338592240c54c328318963b3bb
-
SHA1
0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d
-
SHA256
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
-
SHA512
292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95
Static task
static1
Behavioral task
behavioral1
Sample
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
-
Size
3.9MB
-
MD5
c40e14338592240c54c328318963b3bb
-
SHA1
0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d
-
SHA256
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
-
SHA512
292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-