Analysis
-
max time kernel
117s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 09:49
Static task
static1
General
-
Target
9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe
-
Size
4.1MB
-
MD5
d5635b62d88bca81fd4b2b17d3ff8ec1
-
SHA1
633301c5d8860b6221048ad991349d45ed95d89f
-
SHA256
9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db
-
SHA512
6faca77d1c687721b24c845b06a28be6bbd9abd70a913b269f23b7dbf59cc13918293ae6a47945bac66d70d20f87ad5a53ee661264e7859f1f13cc860f7be494
-
SSDEEP
98304:JguLB9pIJBDUMQIsNtg9zeYM1nhDAwnut7NngV8kagr2L/cO:uuCqIGt915AwnE7NngCgCv
Malware Config
Signatures
-
Glupteba payload 6 IoCs
resource yara_rule behavioral1/memory/536-2-0x00000000052A0000-0x0000000005B8B000-memory.dmp family_glupteba behavioral1/memory/536-3-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral1/memory/536-25-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral1/memory/536-32-0x00000000052A0000-0x0000000005B8B000-memory.dmp family_glupteba behavioral1/memory/536-46-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral1/memory/536-60-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba -
Program crash 1 IoCs
pid pid_target Process procid_target 3360 536 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"1⤵PID:536
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"2⤵PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 8002⤵
- Program crash
PID:3360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 536 -ip 5361⤵PID:4776
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82