Overview

overview

10

Static

static

1

badcbbbb07...eb.exe

windows7-x64

10

badcbbbb07...eb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    218s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 11:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb.exe

  • Size

    4.2MB

  • MD5

    231e2cf23201ef6b4090b896e806d081

  • SHA1

    bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

  • SHA256

    badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

  • SHA512

    f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

  • SSDEEP

    98304:tTJuBaOR1OGnJbTI9ECe5DBuoahLUsGxCDJoG2OZs7RL:He/RZI9Y5lul9nGuJoA2x

Score
10/10
gluptebadropperevasionloaderpersistencetrojan

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 15 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb.exe
    "C:\Users\Admin\AppData\Local\Temp\badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb.exe
      "C:\Users\Admin\AppData\Local\Temp\badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb.exe"
      2⤵
      • Windows security bypass
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Modifies data under HKEY_USERS
          PID:1008
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1804
  • C:\Windows\system32\makecab.exe
    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231015164942.log C:\Windows\Logs\CBS\CbsPersist_20231015164942.cab
    1⤵
      PID:2992

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\rss\csrss.exe
      Filesize

      4.2MB

      MD5

      231e2cf23201ef6b4090b896e806d081

      SHA1

      bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

      SHA256

      badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

      SHA512

      f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

      Download Submit

    • C:\Windows\rss\csrss.exe
      Filesize

      4.2MB

      MD5

      231e2cf23201ef6b4090b896e806d081

      SHA1

      bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

      SHA256

      badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

      SHA512

      f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

      Download Submit

    • C:\Windows\rss\csrss.exe
      Filesize

      4.2MB

      MD5

      231e2cf23201ef6b4090b896e806d081

      SHA1

      bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

      SHA256

      badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

      SHA512

      f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

      Download Submit

    • \Windows\rss\csrss.exe
      Filesize

      4.2MB

      MD5

      231e2cf23201ef6b4090b896e806d081

      SHA1

      bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

      SHA256

      badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

      SHA512

      f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

      Download Submit

    • \Windows\rss\csrss.exe
      Filesize

      4.2MB

      MD5

      231e2cf23201ef6b4090b896e806d081

      SHA1

      bd83b4d462ec1ee2c68aa990b77f7aa7bc53dbf3

      SHA256

      badcbbbb0776e093fc89a93be3cd299c6363f642b749fff197087dd906e8b4eb

      SHA512

      f209636a6098fc88b9599c7ec2afa3d33183fd206e7b2f895ca976cc4fefe19a71505f78b501c65cfed57fafe3d22f18f9004d07ba6c5110c6acba1a02aff542

      Download Submit

    • memory/1624-11-0x0000000002A60000-0x000000000334B000-memory.dmp

      Filesize

      8.9MB

      Download

    • memory/1624-21-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1624-23-0x0000000002660000-0x0000000002A58000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1624-9-0x0000000002660000-0x0000000002A58000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1624-12-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1624-10-0x0000000002660000-0x0000000002A58000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1804-26-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-32-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-37-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-36-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-34-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-28-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/1804-22-0x00000000026E0000-0x0000000002AD8000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1804-24-0x00000000026E0000-0x0000000002AD8000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2912-2-0x0000000002AB0000-0x000000000339B000-memory.dmp

      Filesize

      8.9MB

      Download

    • memory/2912-3-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/2912-0-0x00000000026B0000-0x0000000002AA8000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2912-1-0x00000000026B0000-0x0000000002AA8000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2912-4-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/2912-8-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/2912-5-0x00000000026B0000-0x0000000002AA8000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2912-6-0x0000000002AB0000-0x000000000339B000-memory.dmp

      Filesize

      8.9MB

      Download

    • memory/2912-7-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

      Download