Analysis
-
max time kernel
11s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 02:26
General
-
Target
JC_b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807.exe
-
Size
4.2MB
-
MD5
169d8c38128501ddd877c604f24417a3
-
SHA1
d4038d0476cf6b361adcaaabd746f9a4e27dded4
-
SHA256
b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807
-
SHA512
c2081d9e5c50f4f703f557ad568eef7c491e39b13319ce84cca11ab769e2670ee41a9c4c34523406fe0fe50f3c29a74e884c63ad23baa786ca608a342fd9eb88
-
SSDEEP
98304:/mCQKHB/gIjk/hTwq8fgR3HqTX3kmqCCLlMHbYtXcn:eCVgIjk/hD842X3fTCL5G
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 21 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807.exe"C:\Users\Admin\AppData\Local\Temp\JC_b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JC_b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807.exe"C:\Users\Admin\AppData\Local\Temp\JC_b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
19KB
MD55846995569fd345be0e3e96c1a827384
SHA1a76de3a45a32d36995e8243b7adf0ad73b0ef527
SHA2560a8a771873fc2e33dd68bf327ed8d34d83fd93edf1460bf8b1df95afae07cf09
SHA5128d4b83bd05d69238a36a74a9ce4b8d8f1f2f461652960dd1859feb7e455200b37b8713dadc6ce604e1bfdba449a9fdabf2c44a3a52bdebc17d487449ffbbd1c5
-
Filesize
19KB
MD5e1d724f97fe66b50fb8c8b1d6ba48d05
SHA139ca58fa07cdbb1cdb63e6bf78ee38dcc516438c
SHA256fc5720fab1bacf5e32d9f55d8a50d55fac631c2ef49206cc10fa483fe5f7d9f1
SHA5122de068799a48cad77cc0c3e84536ef7bf7d8c9b499609316d19c047beeb5092207badc61e82a422c55ee21ec892019f237f7e7f4c76b5eed5a75b8e5403004db
-
Filesize
19KB
MD5bb7143e1e3561336aba46559989e30a2
SHA1d474beb4e1199e0e2ed92c20a83d0aeb0a1b15a6
SHA2564d4ff771c547786d414373f2af88bdbb054a624d9d8703a92d979f2565b1cdf6
SHA512ae5f2edf790cb35ae0bfa685214f00afdb206c0b6fff38730b80c2b7e80ea8232c5e6b78b1bf831df0d6c72b5d5cef42b3dd3e5d7e8b9730e0ae9b0e9daf7d15
-
Filesize
19KB
MD5c8c43d2cddef28b4bc07cefd9ab89c2c
SHA15777b544d591bad92ed2616b59c34a13fb3c4bc6
SHA25695d2baef2ac1cb01801d2e88ea6f95017d2f80d3cb3d0ef51ab3f462d45886d5
SHA5123b326f9e99099c0482bb4d72a01a1cc13e660ee9dc5659f978f4419ade9acd9135f2ba0ab76dd7307d6ddf9ff503b9d4c3a85f1f65a130d2821cd303f20b34cb
-
Filesize
19KB
MD5562f55a4eda117e1d3734231606311f2
SHA1f5afb055d4a631ba7f07218c0d92558dea56984c
SHA2562fc076e0fee1faf0465d15b880027b1f8a90f7c67559edb90b54f955e6f44183
SHA512fa26bf9a5933fcd7e3f23335e223a3b56792b00c54e300e2996522e68ee81f0c70a5356fc3b230d956ead3d43fc5d95dbe98f5061193c58cfd5a917c33ae9821
-
Filesize
4.2MB
MD5169d8c38128501ddd877c604f24417a3
SHA1d4038d0476cf6b361adcaaabd746f9a4e27dded4
SHA256b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807
SHA512c2081d9e5c50f4f703f557ad568eef7c491e39b13319ce84cca11ab769e2670ee41a9c4c34523406fe0fe50f3c29a74e884c63ad23baa786ca608a342fd9eb88
-
Filesize
4.2MB
MD5169d8c38128501ddd877c604f24417a3
SHA1d4038d0476cf6b361adcaaabd746f9a4e27dded4
SHA256b691e6ae0f39b098f46f2eb4bcb56813961ca4a40e925a35f44c84739dabe807
SHA512c2081d9e5c50f4f703f557ad568eef7c491e39b13319ce84cca11ab769e2670ee41a9c4c34523406fe0fe50f3c29a74e884c63ad23baa786ca608a342fd9eb88
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
6.2MB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
272KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
136KB
-
Filesize
200KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
8.9MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
8.9MB
-
Filesize
36.1MB
-
Filesize
4.0MB
-
Filesize
36.1MB
-
Filesize
4.0MB