glupteba | 0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a

General

Target

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
Size

3.7MB
MD5

1436af0a5fb6bff43ffae58b7e4e3006
SHA1

119e334c5115fe195d4546625177fd25940abf91
SHA256

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a
SHA512

e2bf820f38284bc6284a41754ed7c6f6868cffb788b26fb2ad635a1e7deb82ffec5d8016289cefc77549c4cfbbaafe590ca84016363c2fdf2617071638f7c2b7

Score

10^/10

glupteba dropper loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-134-0x0000000000400000-0x0000000000B0F000-memory.dmp	family_glupteba
behavioral2/memory/5088-137-0x0000000002D20000-0x0000000003415000-memory.dmp	family_glupteba
behavioral2/memory/2748-138-0x0000000000400000-0x0000000000B0F000-memory.dmp	family_glupteba
behavioral2/memory/2748-139-0x0000000000400000-0x0000000000B0F000-memory.dmp	family_glupteba

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 4136 created 2748 4136 svchost.exe 0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

description	pid	process	target process
PID 4136 created 2748	4136	svchost.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

description	pid	process	target process
PID 5088 set thread context of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

pid	process
2748	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
2748	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2748	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
Token: SeImpersonatePrivilege	2748	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
Token: SeTcbPrivilege	4136	svchost.exe
Token: SeTcbPrivilege	4136	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exesvchost.exe

description	pid	process	target process
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 5088 wrote to memory of 2748	5088	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 4136 wrote to memory of 1800	4136	svchost.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 4136 wrote to memory of 1800	4136	svchost.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
PID 4136 wrote to memory of 1800	4136	svchost.exe	0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe

C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
"C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
"C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe
"C:\Users\Admin\AppData\Local\Temp\0be1ac661b05603a69ef1fa42333798ecd998522b688a3cc9867cfd04c02506a.exe"
3⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-140-0x0000000000000000-mapping.dmp

Download
memory/2748-133-0x0000000000000000-mapping.dmp

Download
memory/2748-134-0x0000000000400000-0x0000000000B0F000-memory.dmp

Filesize
7.1MB

Download
memory/2748-138-0x0000000000400000-0x0000000000B0F000-memory.dmp

Filesize
7.1MB

Download
memory/2748-139-0x0000000000400000-0x0000000000B0F000-memory.dmp

Filesize
7.1MB

Download
memory/5088-135-0x0000000002971000-0x0000000002D17000-memory.dmp

Filesize
3.6MB

Download
memory/5088-137-0x0000000002D20000-0x0000000003415000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads