Overview

overview

10

Static

static

cb934d8876...15.exe

windows7-x64

10

cb934d8876...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220722-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15.exe

  • Size

    5.1MB

  • MD5

    bb1d7230fb4b22c827436a7dd76cf63f

  • SHA1

    d74525bfa6e970e2f9bc74ec35d5755473160720

  • SHA256

    cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15

  • SHA512

    1d03ba3a54253f3ec0cecaccd1bd92d4737c847d0d3aaff8139f5573774458ed35057122ef27c1082c1b0b27cb6a463aa88731e39fd519bf6de39df21b68e68e

Score
10/10
gluptebadropperloader

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15.exe
    "C:\Users\Admin\AppData\Local\Temp\cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15.exe
      "C:\Users\Admin\AppData\Local\Temp\cb934d88760dd5dd7c103eb1de62afb9dfea2bd717aba016d21373224cfffd15.exe"
      2⤵
        PID:3112
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4456

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3112-134-0x0000000000000000-mapping.dmp
      Download
    • memory/4732-132-0x0000000002C22000-0x0000000002FB9000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/4732-133-0x0000000000400000-0x0000000000AE9000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/4732-135-0x0000000000400000-0x0000000000AE9000-memory.dmp
      Filesize

      6.9MB

      Download