Analysis
-
max time kernel
2s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
11/12/2023, 05:03
General
-
Target
854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93.exe
-
Size
4.2MB
-
MD5
1b9c104ac68d0567528307e4c2532bea
-
SHA1
cde18facc1851797579dbe9e99feb530ad62e4e6
-
SHA256
854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93
-
SHA512
c75c4e41ec608239c19bc914eab4b24f4521d2c8fef4657af7a6c7eef1b7df5c5ac8dbae764354e35e73e75832ea2d818f4390d69d741fda69818dc6bdb2dcc2
-
SSDEEP
98304:HhIY/ZhLKAyhXkyfIxGIUjZH7NKtRGgkLyv9SplBkwScPAK1:HbCAyhXOxGIoZH7/W1klqwSe1
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 5 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93.exe"C:\Users\Admin\AppData\Local\Temp\854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93.exe"C:\Users\Admin\AppData\Local\Temp\854361739b523e51e16c164e54bc99334034c9bfa076bba96397cd81d7b63c93.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
9KB
MD57ac6e231f3dec21a2592289c4e7a7d93
SHA1b6eba87c11092d6d2e4435c8af6f5887f744bdac
SHA25620ea834eb9718596039271e91fdacab6a9a7573c0f1e0f547cefa7c331ab97a4
SHA512ecc7b278a01dd997bedd344875cfe37c8b28ca4fa7f5e50224c056f054419939879ce09c50e74bdb29a44115cb498dd66452392add5430044b5da84ce758ad69
-
Filesize
128KB
MD56a862244b16a36a38a28b6c2ef79fd5e
SHA1043522ba63d17b74f288dd464e1668100da05b46
SHA25619da4dc904912303b03bf9d9dbb066ace09a38e4b5e2ecca9fd04963a35cacf9
SHA512ac86c52c6db86183dc8e52064c6bffdcd3c50f1c08341359c345e916c9e29626fdfc19997767287344e4a197fd3034f3ead5570eed0c843340dee69aba1b15c6
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
17KB
MD50b1f7062487932bab4992a4880809ed5
SHA19660eaf08fd9f3f232d00fa02eb24b66b6dd9099
SHA256999d1d2cf312ec86280acd4126554e095f49b46a63f6208e31c42f3366940683
SHA5122763ffef37900ec5516aad63e7fcd0146f3ddde087328cc4f1f71e576bb26e12c88b9be5d5f9985019bff0cfdc7dac4c91022c02fbe650d486b0b7ead907f06e
-
Filesize
18KB
MD5b674df752c05a273bca0d058d174b10e
SHA112e3390f24d26fd584890ec06ec333e5ee4c2a45
SHA25695b7179a1255ca3e1899fb4321d67acbc1bb7ab044f1b62265bb6dea355e5378
SHA5121d3bc4b60a6fbe163e5f159924dfa34f7dcea418ade45f14af4c66974a0eb3ffc68d03314dcea6ca92da55271c7eb1d615e9973a409955e49c9e225e21a04530
-
Filesize
18KB
MD512bf24d9e82a637d34270dc4a30c7f87
SHA1f2092d739b1ad1438bac087195733d34a1d2aea5
SHA25697764af507360b1f778fc5019ffdd3af38aa8d5587eb5888a5edd129aecf8ee9
SHA51265f0308693576c72dc3dc196b7784351055c34e434cf093ed3783472c125cdc8cf4bb0ac69f91e3d0502d988184714183715e7ddcc19d9cd37ff3ff5bf1dd3f5
-
Filesize
18KB
MD52defa7f3fabe148ef470b70dda92678a
SHA1615d8030b8e6b87c5c59c37faf3239aa09c105ca
SHA256c64b0061eb5ca18c5bc755827c7725d8d7fe00e5a9deeee879611f8984350da4
SHA512d802fbe9ef00d0a3fef9084a9d797220f4ba58e4f9afdbab0645659676b61c49d52db37daa10d365693bd838bc85b21e82595bf2209b40b17fb606d62fa4e5fd
-
Filesize
64KB
MD52dc6161a9e46313c68eac2cdd72660ba
SHA1148ea67a0e95189602c2a7f6fc4496146754f73d
SHA2568b8ebdaff69d92059c465144b8da09d367d59939bd80597fe0817b3e97d98cc2
SHA5128cdbc8049cc1bd3656748f75b1aef29d3054a5d43b3099782ad7f113297936be98943229541bdaa5acc538e728de81c2a0a948eed952aa3bbe63502fe477dfbd
-
Filesize
9KB
MD53fce41d3783cb5c31978464ac5040929
SHA1dcd0887eec902e7812370808b02df338e3e0d188
SHA256fa3982d62101d4dfb9f04af7f83997279dbbf19a1e967ede5aed38dfbe24782c
SHA512ec4df595bd47aec1742026a9a8c6afff4e0d5508d92c790036052151ec9fc319c89d9a697dbaf5b372cbe55362948f124484b8f98c7018fb7399290ca53eb6f5
-
Filesize
122KB
MD51fddb2aaf9251145b66a66d6f604979c
SHA1f104fec7504baf81a5d7043c661e69707269d549
SHA2569134cd24b6f064166ba08928a70b1b4d2c634c504d67d2d1353441a62465f29b
SHA512c44a3a31c1e8a61deb78b3e700e195710a90136180d2fba21ce4e24c07df42f8fdbfcee1b2b805df9be36b7f86d06d7261307bbe8370a21e1e0f4ff3a2d0832c
-
Filesize
200KB
MD553b704cba32049ed6681c6eedeef4826
SHA1e7dade8086b75705f78f49e2c706fb8907ec2285
SHA25646fa0244f470935d17c5ffd567f369d72e4687ef97148e0f305d362853ad4d40
SHA512048178fddbde689f92aeade343c79a5b48fb920e3373b8edacfb51018d55d6c1f60c97ac496461918a5edcae2e104f072a778263333f785014341814c3b36278
-
Filesize
223KB
MD58f3e2ddaa2c8fa652dfcefc1cd5609d2
SHA1901cf92ac4b8e855a91efda6368cb57d160f16da
SHA25688e57b97caede434cddbc4effb5468dfa2d849feb63616abcf4433ed2b0da595
SHA5128d3daab9438fe096ac28d059dc4957bc536aad280b85312b8b72ab2f9af56609bbb82c847388d54ed188751248d999bb67926dea474e20a3eb0f3082569dbf7e
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8.9MB
-
Filesize
11.5MB
-
Filesize
4.0MB
-
Filesize
11.5MB
-
Filesize
8.9MB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
11.5MB
-
Filesize
4.0MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
6.9MB
-
Filesize
240KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
136KB
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
472KB
-
Filesize
204KB
-
Filesize
120KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
592KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
216KB
-
Filesize
4.9MB