Analysis
-
max time kernel
0s -
max time network
278s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/12/2023, 05:01
General
-
Target
5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe
-
Size
4.2MB
-
MD5
7d4d5598fa708bdb171c82a4b720a8ab
-
SHA1
54e8db02463f8c2e763f1f4a3aac9f6bdb019c90
-
SHA256
5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f
-
SHA512
0f6a64dbcb85542af858f6178b9b9d63506c447a82310bda1c2d5db62fde2e0a56698a9fdd82113a829bd4d3689946a4c4ce8688a6851b205320450d20bb3530
-
SSDEEP
98304:eonnMgHusXXbQYbgv8h6wxlh0UQ1LNwBMA:LnnMgHZsYbtk5fA
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 23 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Modifies boot configuration data using bcdedit 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231225050117.log C:\Windows\Logs\CBS\CbsPersist_20231225050117.cab1⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB