Analysis

  • max time kernel
    117s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 09:49

General

  • Target

    9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe

  • Size

    4.1MB

  • MD5

    d5635b62d88bca81fd4b2b17d3ff8ec1

  • SHA1

    633301c5d8860b6221048ad991349d45ed95d89f

  • SHA256

    9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db

  • SHA512

    6faca77d1c687721b24c845b06a28be6bbd9abd70a913b269f23b7dbf59cc13918293ae6a47945bac66d70d20f87ad5a53ee661264e7859f1f13cc860f7be494

  • SSDEEP

    98304:JguLB9pIJBDUMQIsNtg9zeYM1nhDAwnut7NngV8kagr2L/cO:uuCqIGt915AwnE7NngCgCv

Score
10/10

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 6 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe
    "C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"
    1⤵
      PID:536
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
          PID:4772
        • C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe
          "C:\Users\Admin\AppData\Local\Temp\9cd1f0c1889afae4bdceb648b7eebbc44a35900a20c262cb8ae991d8d6ebe4db.exe"
          2⤵
            PID:3440
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 800
            2⤵
            • Program crash
            PID:3360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 536 -ip 536
          1⤵
            PID:4776

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k1torbei.tya.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/536-2-0x00000000052A0000-0x0000000005B8B000-memory.dmp

            Filesize

            8.9MB

          • memory/536-3-0x0000000000400000-0x0000000002FB4000-memory.dmp

            Filesize

            43.7MB

          • memory/536-60-0x0000000000400000-0x0000000002FB4000-memory.dmp

            Filesize

            43.7MB

          • memory/536-46-0x0000000000400000-0x0000000002FB4000-memory.dmp

            Filesize

            43.7MB

          • memory/536-32-0x00000000052A0000-0x0000000005B8B000-memory.dmp

            Filesize

            8.9MB

          • memory/536-1-0x0000000004EA0000-0x000000000529D000-memory.dmp

            Filesize

            4.0MB

          • memory/536-27-0x0000000004EA0000-0x000000000529D000-memory.dmp

            Filesize

            4.0MB

          • memory/536-25-0x0000000000400000-0x0000000002FB4000-memory.dmp

            Filesize

            43.7MB

          • memory/4772-30-0x0000000007770000-0x000000000778A000-memory.dmp

            Filesize

            104KB

          • memory/4772-34-0x0000000070090000-0x00000000703E4000-memory.dmp

            Filesize

            3.3MB

          • memory/4772-11-0x0000000005C40000-0x0000000005CA6000-memory.dmp

            Filesize

            408KB

          • memory/4772-21-0x0000000005FA0000-0x00000000062F4000-memory.dmp

            Filesize

            3.3MB

          • memory/4772-22-0x00000000063B0000-0x00000000063CE000-memory.dmp

            Filesize

            120KB

          • memory/4772-23-0x00000000063F0000-0x000000000643C000-memory.dmp

            Filesize

            304KB

          • memory/4772-24-0x00000000067C0000-0x0000000006804000-memory.dmp

            Filesize

            272KB

          • memory/4772-26-0x00000000076D0000-0x0000000007746000-memory.dmp

            Filesize

            472KB

          • memory/4772-9-0x00000000054E0000-0x0000000005502000-memory.dmp

            Filesize

            136KB

          • memory/4772-8-0x00000000055A0000-0x0000000005BC8000-memory.dmp

            Filesize

            6.2MB

          • memory/4772-28-0x0000000004F60000-0x0000000004F70000-memory.dmp

            Filesize

            64KB

          • memory/4772-7-0x0000000004F60000-0x0000000004F70000-memory.dmp

            Filesize

            64KB

          • memory/4772-29-0x0000000007DD0000-0x000000000844A000-memory.dmp

            Filesize

            6.5MB

          • memory/4772-31-0x0000000007930000-0x0000000007962000-memory.dmp

            Filesize

            200KB

          • memory/4772-33-0x000000006FF10000-0x000000006FF5C000-memory.dmp

            Filesize

            304KB

          • memory/4772-10-0x0000000005BD0000-0x0000000005C36000-memory.dmp

            Filesize

            408KB

          • memory/4772-44-0x0000000007910000-0x000000000792E000-memory.dmp

            Filesize

            120KB

          • memory/4772-6-0x0000000004F60000-0x0000000004F70000-memory.dmp

            Filesize

            64KB

          • memory/4772-45-0x0000000007970000-0x0000000007A13000-memory.dmp

            Filesize

            652KB

          • memory/4772-47-0x000000007F7A0000-0x000000007F7B0000-memory.dmp

            Filesize

            64KB

          • memory/4772-5-0x0000000074070000-0x0000000074820000-memory.dmp

            Filesize

            7.7MB

          • memory/4772-48-0x0000000007A60000-0x0000000007A6A000-memory.dmp

            Filesize

            40KB

          • memory/4772-49-0x0000000007B20000-0x0000000007BB6000-memory.dmp

            Filesize

            600KB

          • memory/4772-50-0x0000000007A80000-0x0000000007A91000-memory.dmp

            Filesize

            68KB

          • memory/4772-51-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

            Filesize

            56KB

          • memory/4772-53-0x0000000074070000-0x0000000074820000-memory.dmp

            Filesize

            7.7MB

          • memory/4772-52-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

            Filesize

            80KB

          • memory/4772-54-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

            Filesize

            104KB

          • memory/4772-55-0x0000000007B10000-0x0000000007B18000-memory.dmp

            Filesize

            32KB

          • memory/4772-58-0x0000000074070000-0x0000000074820000-memory.dmp

            Filesize

            7.7MB

          • memory/4772-4-0x0000000004DE0000-0x0000000004E16000-memory.dmp

            Filesize

            216KB