Analysis
-
max time kernel
0s -
max time network
106s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 13:56
General
-
Target
60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d.exe
-
Size
4.1MB
-
MD5
51ad6d074c513e9a1735e4da9b34d615
-
SHA1
63aac45f0526da253b2df6a106c631febffd92a7
-
SHA256
60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d
-
SHA512
d190717a395a931f7948e505b0413cc2dc67f21e4fb4b1783bb44ba7c88655aef458c0e0e78516ea3e82fe6b0c4ae7a18144394172e14dc59ac8aa0a26cc1640
-
SSDEEP
98304:+e6iOIy/yYQAnCMwI/wjPD8qzluFBIaf3An5kQ:+0OkUCrIoj48n5kQ
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 9 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d.exe"C:\Users\Admin\AppData\Local\Temp\60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d.exe"C:\Users\Admin\AppData\Local\Temp\60ea0e105fd73e96c1f9c5af05f1bf55b6a5abb9470881c1d679991a6729c51d.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
7KB
MD5e9dbf60bafb21ba9055b3b641c287772
SHA17296bda9869a3b45f08946307ab331c6f933d2d3
SHA2560849e3d669a67cb0e571def393c43b4e94076c22ab816b16a27db11608b5d012
SHA51212b122408f85c260b1c9e74906ceb159d43b662a0c5341ab7d435b4f04a96b2631f9bdda67866e43f240518d95adea82e429a96abb57c8903aaeef6e769139be
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5191de16fcb054fbf970a1ea367d17ac5
SHA1c81943b3c355321c0bcc57aa961ce92d7e38657b
SHA25684b1db454cc3e2512f36d4475765abcdfdfd6640d2dc3a0d91140125798e8418
SHA51286bea22dc0f9052acf1d20849b1d9de0f98da5f25b9165f0325252fc07893a7ea64eceb16d480a6fa4fa4e66e63848dd1c793fd3b950ae67240e4048fb5eab50
-
Filesize
18KB
MD5d4edaebac20ddb0add0c85d3476d5379
SHA13919a11ce82ae7e1f7b62d1c3d2e9d5b6c7fef61
SHA256a92f14c6dc58c0c394f0b84bf0cbaf5e34d936309eb7c361570b93d6977ba848
SHA512a4a1e347ff4b67db3c9d0df5d2100063bb39ce5f597de7c79ae95c611a5cb290e6b173e63f05bdc55de5b61904d2d0b110d8d37bc67bec1e2a64bc30c1a9876d
-
Filesize
18KB
MD5867f4379ee2c0723bce4d03c646f7f11
SHA1f51f5a93a328a196e40ae1d3e437d7a4f05f8da5
SHA256d2ef8941a14b2acafc547254b1f49ca030adb94af27faf6e58e212dab01b0e97
SHA512bad8175de886185e0a036714a3fa0b28531b623624a05e58d61062fe4fe916c2afa503f1c32f84e1b1c13e8988294c8a6a0552a7be7148c676cf7800d1e3f674
-
Filesize
18KB
MD5dd72e37364bbc2661bb2f57a030af44a
SHA1afd1c6c8a7e89aca41c9bc4bd6ea5cc2e69c5701
SHA256d8c01ad18b765c6e9cb2533c3ba90f50232d2b5c3a91e15845f6fa54221a0806
SHA5121d0c809dc94cb86e114b7df311a368f60ff642b3bc5cf774e4bb51f2b8a2431794176a428f74d13b2bf4cb8f64c7aab7bf821a1e6cba4c78e087455ba5db8f29
-
Filesize
34KB
MD513ded01c4806ab650b890fdbfb1b27f6
SHA1f1207432aa44e0991145e0d35e373eebb9b30483
SHA25632506a46faf4243e4880c5428c778dc21ae9a7e21442a337a5e73d00ac23a8dd
SHA5120fe04e99387852c6fb4936e3c719dfe70dee42be06911026994230f86ffd24d9047a9338a9607843c233632f6b9160beef975a200fcea22f307cc097d3ceea5a
-
Filesize
1KB
MD58b9ea2e72fa7bd7b134f05505298b35b
SHA1b189293ba91f1f77f59c11620c69b496da595d9c
SHA2561381c0866ca7ab1a9a0200fcec14c5a48095f5bc07204fc8f4ba0e0d723361e7
SHA512d2ee251f6fe2d40140829f90f6aa1e798540a9bfa5ce2543da422d3c98065bae269afdc9d65513c7f2b6665c793fd573e7571cc5866932d5809da2efc5e64d56
-
Filesize
300KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
6.9MB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
592KB
-
Filesize
120KB
-
Filesize
204KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
3.3MB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
240KB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
112KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
32KB
-
Filesize
696KB