Overview

overview

10

Static

static

c84050d37a...6b.exe

windows7_x64

10

c84050d37a...6b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b.exe

  • Size

    4.9MB

  • MD5

    9f8c0778a90e69bfa594d46148575a13

  • SHA1

    bd09fc2cd7b4f43e07576a75c9cb2f7ac55557e8

  • SHA256

    c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b

  • SHA512

    bb30fbd73ac88cf424420aa71fbe058f5bcbaac2dd25bd988e7cb664f34ec60171978982479d526dc01c046fe16b7c44e61fc6277c58027817ba87fb26bd38f9

Score
10/10
gluptebadropperevasionloaderpersistencesuricata

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

    suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

    suricata
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b.exe
    "C:\Users\Admin\AppData\Local\Temp\c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3896
    • C:\Users\Admin\AppData\Local\Temp\c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b.exe
      "C:\Users\Admin\AppData\Local\Temp\c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
            PID:2100
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
            4⤵
              PID:4564
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe ""
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:3016
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4648

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      2
      T1112

      Install Root Certificate

      1
      T1130

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\rss\csrss.exe
        Filesize

        4.9MB

        MD5

        9f8c0778a90e69bfa594d46148575a13

        SHA1

        bd09fc2cd7b4f43e07576a75c9cb2f7ac55557e8

        SHA256

        c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b

        SHA512

        bb30fbd73ac88cf424420aa71fbe058f5bcbaac2dd25bd988e7cb664f34ec60171978982479d526dc01c046fe16b7c44e61fc6277c58027817ba87fb26bd38f9

        Download Submit
      • C:\Windows\rss\csrss.exe
        Filesize

        4.9MB

        MD5

        9f8c0778a90e69bfa594d46148575a13

        SHA1

        bd09fc2cd7b4f43e07576a75c9cb2f7ac55557e8

        SHA256

        c84050d37aa53bcadb044ac745a47c47b568541b19305de99b7bf029fd2fc16b

        SHA512

        bb30fbd73ac88cf424420aa71fbe058f5bcbaac2dd25bd988e7cb664f34ec60171978982479d526dc01c046fe16b7c44e61fc6277c58027817ba87fb26bd38f9

        Download Submit
      • memory/2100-136-0x0000000000000000-mapping.dmp
        Download
      • memory/2812-133-0x000000000346C000-0x0000000003804000-memory.dmp
        Filesize

        3.6MB

        Download
      • memory/2812-134-0x0000000000400000-0x00000000010F7000-memory.dmp
        Filesize

        13.0MB

        Download
      • memory/2812-132-0x0000000000000000-mapping.dmp
        Download
      • memory/3016-139-0x0000000000000000-mapping.dmp
        Download
      • memory/3016-142-0x0000000003900000-0x0000000003C98000-memory.dmp
        Filesize

        3.6MB

        Download
      • memory/3016-143-0x0000000000400000-0x00000000010F7000-memory.dmp
        Filesize

        13.0MB

        Download
      • memory/3372-137-0x0000000000000000-mapping.dmp
        Download
      • memory/3896-130-0x0000000003536000-0x00000000038CE000-memory.dmp
        Filesize

        3.6MB

        Download
      • memory/3896-131-0x0000000000400000-0x00000000010F7000-memory.dmp
        Filesize

        13.0MB

        Download
      • memory/4088-135-0x0000000000000000-mapping.dmp
        Download
      • memory/4564-138-0x0000000000000000-mapping.dmp
        Download