Analysis
-
max time kernel
5s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 02:51
General
-
Target
JC_55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379.exe
-
Size
4.2MB
-
MD5
a1439a03495ae2aefac6d2d6f42482a2
-
SHA1
a4198f3902590847286b61a1d7c61571ad44161a
-
SHA256
55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379
-
SHA512
ac77d83a82be83df4baa756dafa686b3bc5a5db23e3ffa374db85a0cba5255a0eebd2323f111a4ba56a83760b93d139ccb9df6f048c93c2bc086e6006db1e36b
-
SSDEEP
98304:lUXt9//byb+aA4mV8FjZFBpd6xZ1Y6LSs6derlK9PWlHc5:gRbyb+8HFFnd6rCESs6ch8oHG
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 18 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379.exe"C:\Users\Admin\AppData\Local\Temp\JC_55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JC_55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379.exe"C:\Users\Admin\AppData\Local\Temp\JC_55b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.6MB
MD5026eaee3c279cdcff5bdd77560a473f9
SHA1bea764a6e20ade8100ccfdcc16e847a885893681
SHA25673a562a2f8712bcc5a97b1ca15cca02dbc8d70e0307bd0d78a69e3f98c738be5
SHA512e3e318760c9677349c5a22ede6f48c8ea8973c7ee6ec1bac3d8e2b56400d76026fbceebd3db57aa697a89e70ff7d0ef5d8afa08fc0e3ad0acb3208650f98baf2
-
Filesize
2.9MB
MD56b090b07e1ffcaf07da7de32a349519a
SHA1c20cbc6e37ffbdb3e3a014a423e3303b8ce8e70f
SHA256b972e7d5dc570e8cad1fc9e8d8009cabdeb4933deb7b56525ce1006cdd904ea3
SHA512b0e922fef0abf31c053ed1736b227c1a7634deabe401530f33473d3fbe47f818dc2f88beb59e80ba134b3542db45aa523d2c1f7970d867dcfb0f2038f107d758
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD569187a245da4b59126b3d7ce15ec41e5
SHA14b1fc8234ba1cd66765c1841753dafb7f4bbf388
SHA256889e25fd542b6dc0b8b6c4e24477dcf81d94c2e7acd513327035cf25c597cc27
SHA5122460e7023444c84bfce4100a19ffade68918afe65b0c0f230843be1360db4a69c63cf3a41fc619c7df89dc6887b01916dc0ac3836623072c5823d0c120837030
-
Filesize
19KB
MD54be430634de311ffa20a19f4566156d8
SHA198f240ff2c9bd20baa2b8628c0cf02236902a4d0
SHA256428984502408ff0cad36fd07b3b90e7ac29d6b0bdea3c84b443f230a3f881ce7
SHA512918188d26119a6b01560fd3ee1f2aa70341d58b658ffbf5445c25f6f0bb78135f7f88abf39b3607ed905dcbd2013a35537741f98c81937e3e019490f9945e608
-
Filesize
19KB
MD52076615cee2636c7c1ef037d3e60543e
SHA1f11a65f4b5b1c3ee4b43c777608c4991887e347d
SHA25617e90cb6212715500d92a977b0d4606a624e481a9b544a2c5b2f7106d19800b6
SHA512146e4ecff5d5b2694ddba265221fde5fba7aad8dce63fdd41cd795a5a7105ce00ec1bc5385f8c37ac1defb2835205374da376a0847e58cfd9ac6d3c942ce0d04
-
Filesize
19KB
MD5083ca2363a1086c936878dbd7f7ac20a
SHA19ab4742ce5f6a30132c666e8b2ea4eb573baa547
SHA256cd55a27fb7b1b92a6242d9dbb90fb9134ebc6207cbeac717bd82a05b1bb6975c
SHA5125523e1214e2f7c043f3148169fecbd5a9b6419b6a6f51a77c11df87b69b85e157f3d3e9d8ac27339a010177eb2fe07019f18e42254dfe1e86a450d2b42d4397e
-
Filesize
19KB
MD5666b0b38ba1870bd87def3d1a92918d4
SHA19b299e698b67de97a44f60c7c06f29ee2a3a2cef
SHA2565d782cef61756f790e1d9cbc3e84112bb85fd9264c5a380ce07041a016f33b50
SHA512f810cc0d2c181d1c5809ef4e0bae459cc8e0fd7354c08f61d7d93dcdc3fc1867c1f8ecfeebb9aa47704226d9f906fd9851741b077f2200bc495a692db470341b
-
Filesize
4.2MB
MD5a1439a03495ae2aefac6d2d6f42482a2
SHA1a4198f3902590847286b61a1d7c61571ad44161a
SHA25655b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379
SHA512ac77d83a82be83df4baa756dafa686b3bc5a5db23e3ffa374db85a0cba5255a0eebd2323f111a4ba56a83760b93d139ccb9df6f048c93c2bc086e6006db1e36b
-
Filesize
4.2MB
MD5a1439a03495ae2aefac6d2d6f42482a2
SHA1a4198f3902590847286b61a1d7c61571ad44161a
SHA25655b01de7a08a166414e2e509184d2715dab72ae24aeaabe3a9ed802e0c04b379
SHA512ac77d83a82be83df4baa756dafa686b3bc5a5db23e3ffa374db85a0cba5255a0eebd2323f111a4ba56a83760b93d139ccb9df6f048c93c2bc086e6006db1e36b
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
4.9MB
-
Filesize
36.1MB
-
Filesize
4.0MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
272KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
472KB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
652KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
36.1MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
8.9MB
-
Filesize
8.9MB