glupteba | c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d

Analysis

max time kernel
182s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe
Size

4.2MB
MD5

aa08c6b0100709dc87d4d6683b55ed9e
SHA1

14d136b68b76b59cf298b82426756bd3f27565a7
SHA256

c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d
SHA512

206846f1da627d04078d32e8ff84d89832bcfd3d3ef0da4190a7d3c334b450527d3072ef46676a8fafb9949c9cc899ce235d6cdaf994d65da8596dc5d8e546c5
SSDEEP

98304:92/XcUYSj5GEz9aDhx67pCMEgki1u3FmmKmQutIK0kbCc4ZdPHwU:CXwEJaDhx6gMVt1u3l+utX0kbl4ZFh

Score

10^/10

glupteba dropper loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 9 IoCs

resource	yara_rule
behavioral2/memory/3064-2-0x0000000002FD0000-0x00000000038BB000-memory.dmp	family_glupteba
behavioral2/memory/3064-3-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-5-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-6-0x0000000002FD0000-0x00000000038BB000-memory.dmp	family_glupteba
behavioral2/memory/3064-7-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-8-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-14-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-38-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3064-50-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	powershell.exe
3784	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3784	3064	JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe	89
PID 3064 wrote to memory of 3784	3064	JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe	89
PID 3064 wrote to memory of 3784	3064	JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe	89

C:\Users\Admin\AppData\Local\Temp\JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe
"C:\Users\Admin\AppData\Local\Temp\JC_c0c1935cacdc176c8e6b4297e65e5fa12aa12836d44ab026b6932f5c69dbd94d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n221jjqg.gqg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3064-14-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-2-0x0000000002FD0000-0x00000000038BB000-memory.dmp

Filesize
8.9MB

Download
memory/3064-3-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-4-0x0000000002BD0000-0x0000000002FCB000-memory.dmp

Filesize
4.0MB

Download
memory/3064-5-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-6-0x0000000002FD0000-0x00000000038BB000-memory.dmp

Filesize
8.9MB

Download
memory/3064-7-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-8-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-50-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-38-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3064-1-0x0000000002BD0000-0x0000000002FCB000-memory.dmp

Filesize
4.0MB

Download
memory/3784-29-0x0000000005D10000-0x0000000005D5C000-memory.dmp

Filesize
304KB

Download
memory/3784-11-0x0000000004680000-0x00000000046B6000-memory.dmp

Filesize
216KB

Download
memory/3784-15-0x0000000004D60000-0x0000000004D82000-memory.dmp

Filesize
136KB

Download
memory/3784-16-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/3784-17-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/3784-12-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-27-0x0000000005760000-0x0000000005AB4000-memory.dmp

Filesize
3.3MB

Download
memory/3784-28-0x0000000005CD0000-0x0000000005CEE000-memory.dmp

Filesize
120KB

Download
memory/3784-10-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-30-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/3784-31-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-33-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-34-0x0000000006110000-0x0000000006154000-memory.dmp

Filesize
272KB

Download
memory/3784-36-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-37-0x0000000006F70000-0x0000000006FE6000-memory.dmp

Filesize
472KB

Download
memory/3784-13-0x0000000004E20000-0x0000000005448000-memory.dmp

Filesize
6.2MB

Download
memory/3784-42-0x00000000047E0000-0x00000000047F0000-memory.dmp

Filesize
64KB

Download
memory/3784-47-0x00000000076D0000-0x0000000007D4A000-memory.dmp

Filesize
6.5MB

Download
memory/3784-48-0x00000000006E0000-0x00000000006FA000-memory.dmp

Filesize
104KB

Download
memory/3784-9-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/3784-51-0x000000007F700000-0x000000007F710000-memory.dmp

Filesize
64KB

Download
memory/3784-52-0x0000000007050000-0x0000000007082000-memory.dmp

Filesize
200KB

Download
memory/3784-53-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/3784-54-0x0000000070530000-0x0000000070884000-memory.dmp

Filesize
3.3MB

Download
memory/3784-64-0x0000000007010000-0x000000000702E000-memory.dmp

Filesize
120KB

Download
memory/3784-65-0x0000000007190000-0x0000000007233000-memory.dmp

Filesize
652KB

Download
memory/3784-67-0x000000007F700000-0x000000007F710000-memory.dmp

Filesize
64KB

Download
memory/3784-69-0x0000000007280000-0x000000000728A000-memory.dmp

Filesize
40KB

Download
memory/3784-70-0x0000000007430000-0x00000000074C6000-memory.dmp

Filesize
600KB

Download
memory/3784-72-0x0000000007290000-0x00000000072A1000-memory.dmp

Filesize
68KB

Download