Analysis

  • max time kernel
    126s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:22

General

  • Target

    deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56.exe

  • Size

    3.8MB

  • MD5

    22e41f02396fedc90ca02608270a7ab9

  • SHA1

    79548d0a0d9a43fe4f860caf80026f4bf4421af9

  • SHA256

    deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56

  • SHA512

    580f799847856bb70b4562428a5d126268f571b26eea4d3167a16c2a9aad33c1a8e4b8fd3baa48d3e72d71c08be96b48830eb617a5f868af83b22d7dcb436a5e

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

    suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56.exe
    "C:\Users\Admin\AppData\Local\Temp\deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56.exe
      "C:\Users\Admin\AppData\Local\Temp\deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
            PID:2408
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
            4⤵
              PID:4772
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe ""
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:4420
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4184

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Install Root Certificate

      1
      T1130

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\rss\csrss.exe
        Filesize

        3.8MB

        MD5

        22e41f02396fedc90ca02608270a7ab9

        SHA1

        79548d0a0d9a43fe4f860caf80026f4bf4421af9

        SHA256

        deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56

        SHA512

        580f799847856bb70b4562428a5d126268f571b26eea4d3167a16c2a9aad33c1a8e4b8fd3baa48d3e72d71c08be96b48830eb617a5f868af83b22d7dcb436a5e

      • C:\Windows\rss\csrss.exe
        Filesize

        3.8MB

        MD5

        22e41f02396fedc90ca02608270a7ab9

        SHA1

        79548d0a0d9a43fe4f860caf80026f4bf4421af9

        SHA256

        deb4b9b05672e74a6152ac95d299815ce5f15e6953aed784907c54e1addfbe56

        SHA512

        580f799847856bb70b4562428a5d126268f571b26eea4d3167a16c2a9aad33c1a8e4b8fd3baa48d3e72d71c08be96b48830eb617a5f868af83b22d7dcb436a5e

      • memory/2408-137-0x0000000000000000-mapping.dmp
      • memory/3364-136-0x0000000000400000-0x0000000000B0A000-memory.dmp
        Filesize

        7.0MB

      • memory/3364-135-0x000000000106F000-0x0000000001413000-memory.dmp
        Filesize

        3.6MB

      • memory/3364-133-0x0000000000000000-mapping.dmp
      • memory/3548-134-0x0000000000000000-mapping.dmp
      • memory/4420-140-0x0000000000000000-mapping.dmp
      • memory/4420-143-0x0000000001500000-0x00000000018A4000-memory.dmp
        Filesize

        3.6MB

      • memory/4420-144-0x0000000000400000-0x0000000000B0A000-memory.dmp
        Filesize

        7.0MB

      • memory/4772-139-0x0000000000000000-mapping.dmp
      • memory/4828-138-0x0000000000000000-mapping.dmp
      • memory/5012-130-0x0000000001124000-0x00000000014C8000-memory.dmp
        Filesize

        3.6MB

      • memory/5012-132-0x0000000000400000-0x0000000000B0A000-memory.dmp
        Filesize

        7.0MB

      • memory/5012-131-0x00000000014D0000-0x0000000001BBF000-memory.dmp
        Filesize

        6.9MB