glupteba | fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657

Analysis

max time kernel
90s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 05:49

Target

fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657.exe
Size

4.1MB
MD5

f36ffc87d4ad725893400195adc30b80
SHA1

43c401ebab2dce88a3b8bf46da352d3d0d85b7f0
SHA256

fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657
SHA512

871c99269f3c0d928c0ce1f28529cad6c715cce20b90da85a9748320c5aa7aecdd81a01058b0e8121ca960a8c052f3e261807f6006f8f9f9ca0ad05c65aebeb9
SSDEEP

98304:lXpdC+AG3N331+0ioxXOrXg4JLXEXtwxhH0Q4t1aUlB7T3/YZv4wh0NM:1lAG3iKwg4JLXECj0rzPvYZvJh0NM

Score

10^/10

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4824-134-0x0000000005100000-0x0000000005977000-memory.dmp	family_glupteba
behavioral1/memory/4824-135-0x0000000000400000-0x0000000002F48000-memory.dmp	family_glupteba

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 4824 WerFault.exe fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657.exe

pid	pid_target	process	target process
2028	4824	WerFault.exe	fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657.exe

C:\Users\Admin\AppData\Local\Temp\fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657.exe
"C:\Users\Admin\AppData\Local\Temp\fb5faebad84d764079e74d66b0e1237127f7d720061eef1f36e30dd317c94657.exe"
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 272
2⤵
- Program crash
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4824 -ip 4824
1⤵
PID:3464

memory/4824-134-0x0000000005100000-0x0000000005977000-memory.dmp

Filesize
8.5MB

Download
memory/4824-135-0x0000000000400000-0x0000000002F48000-memory.dmp

Filesize
43.3MB

Download