General
-
Target
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658
-
Size
6.5MB
-
Sample
220731-hkqc9aebcm
-
MD5
050903ca80a4ffa4f0e1f8b47a4c5431
-
SHA1
0d862981900ed4e37c31cbbba6dd97f882472af6
-
SHA256
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658
-
SHA512
73256495cb541227641263b57331fa53a6f858e83c9623e7bc36a7da0494eb55d173e5a181c2ded0472c4c58aa21b748cb107cbc33785e98ad8fba93a5166ac3
Static task
static1
Behavioral task
behavioral1
Sample
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658.exe
Resource
win10v2004-20220722-en
Malware Config
Targets
-
-
Target
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658
-
Size
6.5MB
-
MD5
050903ca80a4ffa4f0e1f8b47a4c5431
-
SHA1
0d862981900ed4e37c31cbbba6dd97f882472af6
-
SHA256
e3dba9dea45b3c03138168d4c71b64742b40bf69afa432396b62beb288b04658
-
SHA512
73256495cb541227641263b57331fa53a6f858e83c9623e7bc36a7da0494eb55d173e5a181c2ded0472c4c58aa21b748cb107cbc33785e98ad8fba93a5166ac3
-
Glupteba payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-