glupteba | d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17

Analysis

max time kernel
16s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2023 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe
Size

4.1MB
MD5

7e96bb94713cc73276b75486f6c7c003
SHA1

2f33ac10b3c45f074c2ef51ff9cb84aa9ce9abd0
SHA256

d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17
SHA512

0463c93f34941a1d9ac052cabe0c6112ae0af4253368819c0111d804961c5ca2486645ae2f5df8c4c4aa918c79c56cfa1032b57e58da713ddfb280fe9809e77d
SSDEEP

98304:8VBi+0Z15M0rtSUjgCQGsc3jNApFJZxqIxlM4iYtpS:8gLJrYUcGsc34FbxFnM4impS

Score

10^/10

glupteba dropper loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

resource	yara_rule
behavioral1/memory/1000-134-0x0000000005330000-0x0000000005C1B000-memory.dmp	family_glupteba
behavioral1/memory/1000-173-0x0000000000400000-0x00000000030CB000-memory.dmp	family_glupteba
behavioral1/memory/1000-179-0x0000000000400000-0x00000000030CB000-memory.dmp	family_glupteba

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3088	powershell.exe
3088	powershell.exe
1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe
1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe
Token: SeImpersonatePrivilege	1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 3088	1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe	79
PID 1000 wrote to memory of 3088	1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe	79
PID 1000 wrote to memory of 3088	1000	d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe	79

C:\Users\Admin\AppData\Local\Temp\d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe
"C:\Users\Admin\AppData\Local\Temp\d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe
  "C:\Users\Admin\AppData\Local\Temp\d620ae8752171d950001c2ba0c4d349927d03976cb6edef18ec874b86c4b9e17.exe"
  2⤵
  PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skebtszv.poc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1000-179-0x0000000000400000-0x00000000030CB000-memory.dmp

Filesize
44.8MB

Download
memory/1000-173-0x0000000000400000-0x00000000030CB000-memory.dmp

Filesize
44.8MB

Download
memory/1000-134-0x0000000005330000-0x0000000005C1B000-memory.dmp

Filesize
8.9MB

Download
memory/3088-154-0x0000000008110000-0x000000000878A000-memory.dmp

Filesize
6.5MB

Download
memory/3088-157-0x0000000007C60000-0x0000000007C92000-memory.dmp

Filesize
200KB

Download
memory/3088-140-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/3088-138-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/3088-146-0x00000000060E0000-0x0000000006146000-memory.dmp

Filesize
408KB

Download
memory/3088-151-0x0000000006720000-0x000000000673E000-memory.dmp

Filesize
120KB

Download
memory/3088-152-0x0000000006AF0000-0x0000000006B34000-memory.dmp

Filesize
272KB

Download
memory/3088-153-0x0000000007810000-0x0000000007886000-memory.dmp

Filesize
472KB

Download
memory/3088-137-0x0000000005920000-0x0000000005F48000-memory.dmp

Filesize
6.2MB

Download
memory/3088-155-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Filesize
104KB

Download
memory/3088-156-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/3088-139-0x0000000005810000-0x0000000005832000-memory.dmp

Filesize
136KB

Download
memory/3088-158-0x0000000070960000-0x00000000709AC000-memory.dmp

Filesize
304KB

Download
memory/3088-159-0x0000000070AE0000-0x0000000070E34000-memory.dmp

Filesize
3.3MB

Download
memory/3088-169-0x0000000007C40000-0x0000000007C5E000-memory.dmp

Filesize
120KB

Download
memory/3088-170-0x0000000007D90000-0x0000000007D9A000-memory.dmp

Filesize
40KB

Download
memory/3088-171-0x000000007F6F0000-0x000000007F700000-memory.dmp

Filesize
64KB

Download
memory/3088-172-0x0000000007E60000-0x0000000007EF6000-memory.dmp

Filesize
600KB

Download
memory/3088-136-0x0000000003100000-0x0000000003136000-memory.dmp

Filesize
216KB

Download
memory/3088-174-0x0000000007E10000-0x0000000007E1E000-memory.dmp

Filesize
56KB

Download
memory/3088-175-0x0000000007F00000-0x0000000007F1A000-memory.dmp

Filesize
104KB

Download
memory/3088-176-0x0000000007E50000-0x0000000007E58000-memory.dmp

Filesize
32KB

Download
memory/3088-135-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download