Overview

overview

10

Static

static

1

ee978795ce...6b.exe

windows7-x64

10

ee978795ce...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    71s
  • max time network
    91s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 12:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b.exe

  • Size

    4.1MB

  • MD5

    fa0223ee222025f28664c11e3699b0b4

  • SHA1

    38394bd4abb6042bac20512c2a229400997274ba

  • SHA256

    ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

  • SHA512

    348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

  • SSDEEP

    98304:CRebotf7VEwlZaK5tBPzNfl6TiolnFsycGc2+UcSX84gbqKEDG:KwotDVJZa0PYdv7ZsRTEa

Score
10/10
gluptebadropperevasionloaderpersistencetrojan

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 13 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b.exe
    "C:\Users\Admin\AppData\Local\Temp\ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b.exe
      "C:\Users\Admin\AppData\Local\Temp\ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b.exe"
      2⤵
      • Windows security bypass
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Modifies data under HKEY_USERS
          PID:520
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        PID:728
  • C:\Windows\system32\makecab.exe
    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231016033628.log C:\Windows\Logs\CBS\CbsPersist_20231016033628.cab
    1⤵
      PID:2600

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            fa0223ee222025f28664c11e3699b0b4

            SHA1

            38394bd4abb6042bac20512c2a229400997274ba

            SHA256

            ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

            SHA512

            348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

            Download Submit

          • C:\Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            fa0223ee222025f28664c11e3699b0b4

            SHA1

            38394bd4abb6042bac20512c2a229400997274ba

            SHA256

            ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

            SHA512

            348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

            Download Submit

          • C:\Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            fa0223ee222025f28664c11e3699b0b4

            SHA1

            38394bd4abb6042bac20512c2a229400997274ba

            SHA256

            ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

            SHA512

            348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

            Download Submit

          • \Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            fa0223ee222025f28664c11e3699b0b4

            SHA1

            38394bd4abb6042bac20512c2a229400997274ba

            SHA256

            ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

            SHA512

            348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

            Download Submit

          • \Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            fa0223ee222025f28664c11e3699b0b4

            SHA1

            38394bd4abb6042bac20512c2a229400997274ba

            SHA256

            ee978795ce34610a8d17fd3ea8349e23ec5e2eea6e8d0a51b2dd65432f621e6b

            SHA512

            348cae2fa1672a3c673589bf7af4007a1400061f27491e2ca9f78eead7468fdb5a5b214660c1ef23118563fc824d6d197f13047334594c0cf9310ec2ca67eafd

            Download Submit

          • memory/728-29-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/728-27-0x0000000002660000-0x0000000002A58000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/728-26-0x0000000002660000-0x0000000002A58000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2228-6-0x00000000029D0000-0x00000000032BB000-memory.dmp

            Filesize

            8.9MB

            Download

          • memory/2228-5-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-10-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-1-0x00000000025D0000-0x00000000029C8000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2228-2-0x00000000029D0000-0x00000000032BB000-memory.dmp

            Filesize

            8.9MB

            Download

          • memory/2228-3-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-13-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-4-0x00000000025D0000-0x00000000029C8000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2228-9-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-8-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-7-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2228-0-0x00000000025D0000-0x00000000029C8000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2524-25-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2524-16-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2524-15-0x0000000002690000-0x0000000002A88000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2524-14-0x0000000000400000-0x0000000000D1B000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2524-12-0x0000000002690000-0x0000000002A88000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2524-11-0x0000000002690000-0x0000000002A88000-memory.dmp

            Filesize

            4.0MB

            Download