glupteba | 82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8

General

Target

82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe
Size

3.8MB
MD5

52242b0f18fda799a91931a570e9ef81
SHA1

6cf0427991c4bbf47aee799e6e1b84fcfad3292f
SHA256

82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8
SHA512

215a5ddd6c2465ec1b4bf44d7c928d12ff9eca5d5c262376fa38a3a268fe2478e8e484e25593f18fe143e414f750385b2e6ce5823fdb26886c8d1b452015a4f0
SSDEEP

98304:Mrq57kIMGwK/DfC/XQuFEQ4xmGR/DOFEBlyHMtw8Uj+31Lc:M4VZJbo9Axmi/D8EBlystO+

Score

10^/10

glupteba metasploit backdoor dropper evasion loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1484-56-0x0000000003990000-0x0000000004192000-memory.dmp	family_glupteba
behavioral1/memory/1484-57-0x0000000000400000-0x0000000003352000-memory.dmp	family_glupteba
behavioral1/memory/1484-58-0x0000000000400000-0x0000000003352000-memory.dmp	family_glupteba
behavioral1/memory/1484-59-0x0000000003990000-0x0000000004192000-memory.dmp	family_glupteba
behavioral1/memory/1484-60-0x0000000000400000-0x0000000003352000-memory.dmp	family_glupteba
behavioral1/memory/1844-63-0x0000000000400000-0x0000000003352000-memory.dmp	family_glupteba
behavioral1/memory/1844-64-0x0000000000400000-0x0000000003352000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2012 netsh.exe

pid	process
2012	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe

pid	process
1484	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe
1844	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe

description	pid	process
Token: SeDebugPrivilege	1484	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe
Token: SeImpersonatePrivilege	1484	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.execmd.exe

description	pid	process	target process
PID 1844 wrote to memory of 852	1844	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe	cmd.exe
PID 1844 wrote to memory of 852	1844	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe	cmd.exe
PID 1844 wrote to memory of 852	1844	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe	cmd.exe
PID 1844 wrote to memory of 852	1844	82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe	cmd.exe
PID 852 wrote to memory of 2012	852	cmd.exe	netsh.exe
PID 852 wrote to memory of 2012	852	cmd.exe	netsh.exe
PID 852 wrote to memory of 2012	852	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe
"C:\Users\Admin\AppData\Local\Temp\82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Users\Admin\AppData\Local\Temp\82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe
"C:\Users\Admin\AppData\Local\Temp\82f34e859b458036d7f847a70b616c244aed28dc6e51c99e6c6ce144857e56c8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2012

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20221125162522.log C:\Windows\Logs\CBS\CbsPersist_20221125162522.cab
1⤵
PID:1680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-65-0x0000000000000000-mapping.dmp

Download
memory/1484-60-0x0000000000400000-0x0000000003352000-memory.dmp

Filesize
47.3MB

Download
memory/1484-56-0x0000000003990000-0x0000000004192000-memory.dmp

Filesize
8.0MB

Download
memory/1484-57-0x0000000000400000-0x0000000003352000-memory.dmp

Filesize
47.3MB

Download
memory/1484-58-0x0000000000400000-0x0000000003352000-memory.dmp

Filesize
47.3MB

Download
memory/1484-59-0x0000000003990000-0x0000000004192000-memory.dmp

Filesize
8.0MB

Download
memory/1484-54-0x00000000035E0000-0x0000000003987000-memory.dmp

Filesize
3.7MB

Download
memory/1484-55-0x00000000035E0000-0x0000000003987000-memory.dmp

Filesize
3.7MB

Download
memory/1844-61-0x0000000003550000-0x00000000038F7000-memory.dmp

Filesize
3.7MB

Download
memory/1844-62-0x0000000003550000-0x00000000038F7000-memory.dmp

Filesize
3.7MB

Download
memory/1844-63-0x0000000000400000-0x0000000003352000-memory.dmp

Filesize
47.3MB

Download
memory/1844-64-0x0000000000400000-0x0000000003352000-memory.dmp

Filesize
47.3MB

Download
memory/2012-66-0x0000000000000000-mapping.dmp

Download
memory/2012-67-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads