Analysis
-
max time kernel
0s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
-
submitted
25-12-2023 05:01
General
-
Target
5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe
-
Size
4.2MB
-
MD5
7d4d5598fa708bdb171c82a4b720a8ab
-
SHA1
54e8db02463f8c2e763f1f4a3aac9f6bdb019c90
-
SHA256
5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f
-
SHA512
0f6a64dbcb85542af858f6178b9b9d63506c447a82310bda1c2d5db62fde2e0a56698a9fdd82113a829bd4d3689946a4c4ce8688a6851b205320450d20bb3530
-
SSDEEP
98304:eonnMgHusXXbQYbgv8h6wxlh0UQ1LNwBMA:LnnMgHZsYbtk5fA
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 21 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"C:\Users\Admin\AppData\Local\Temp\5b543527b4b8a1d52a9f459a5103d435b6bc38df56af7cd42b2c28020f56098f.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
56KB
MD5b16bc66763e709a39dbd5498b49951d4
SHA1ca9b69024b140484aa3935e2c7303ee96a5984c7
SHA2564d1b47ac1932cbfc7af981229d3db75182c3638b6b905a9da70256d15e7aba2e
SHA512fd3b742e46e599528ad8acd9f8ce38c8c43ffc9ebf456e18c1702a839782a9d1446e71cc2680a8c12a9e9eac3902abd46589c9f3035030d09e9187b3974e8b68
-
Filesize
38KB
MD504d259c62b348534859fb9def64af831
SHA1d73f0a28616a433adf413eaa8efd82640b555fb6
SHA25633287d26d240d793d48889b8205abf43b029491a5065a0e5e8a0dc1f477f3994
SHA512badabc10f69c69ea6ad109b8a52f3e2fea4defdcd7cb3945ab60bc95f36d031d646bbddebb072ae4c28ba17a5605277cfa1b1d1c1eb602c45b43364ba531b04c
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5e634aec6c071a4a250ed8f06fbfc215a
SHA162e52d569566e1cf889ccf58b179dd0203e9fe29
SHA256a7cb9240d7fb299d814efe9227cd9495260dbc4f1dc3b241a9e2ca943b81d98d
SHA51216b4f9acf4a5ea9362c156404c41ab79edaf080c4bce3bb83ddce46953a7154727dd9948f2be6281e0887928ab6617f28889fe6bd8ede3ea295c3831c1c44745
-
Filesize
18KB
MD50d5990afee88902c509c332cd295968e
SHA13c14e0a11e35b78b4c19c507764946cdcf9764aa
SHA2562ca9363c6cb27865636e94824a7a47f731ecdfbbdbfc2f43a7e0c5abf67a4e2b
SHA512a3f5778408ff57ba2aee4219d1667ebcb58d1899660e517aee66f81c22c8d63bc8ef01ad90dfb92bd2697069d35448280fb8511f7fdaf1cce9135ce8004c69ba
-
Filesize
18KB
MD5de7647e2fb92202cbc42a4f91bebc0d4
SHA17dfca469d1dde2696b79d555505491a60765ddd4
SHA2569ce2f45a41cd0a8ac31a146246282fcdd3da5fd592e7b0b16b3fd580b9ecd4ee
SHA512b3d0bfb8ed9d5ffa20259b102972583393fc3eef6aad3245dc3ab3e5a8945a89d1d662e10c0d840463119bc08bc6f01d0aad265165832f787ad63e9a7bae08ff
-
Filesize
18KB
MD5ec6f4a1ad089d81b93e026751ac5b42d
SHA111da13e64a92098eab5fe327bbc0a564ad02756f
SHA2564cddd0d661771bd2ee184a1583fcbedb44e23f17d57e39a19b99da116bc367ec
SHA512e2a80631eab5e9dfaadce4242d27e39d26d776a42b67272e9ae622f7ca80736ebeae98ac3a2f6d9d627675440147c8979c34bc1fe6684c778f5f723d0effae43
-
Filesize
18KB
MD5e5e95f3aa4c04d12cdb4c27ad38127b2
SHA1fe37b5f9e75d90481ccbadac9d21dbe80d9769d1
SHA256b250a0ed4825ad7caf19286ed3197b040251ab60492d454b8a1867b43f0135e3
SHA512e34f2ef395a20d1698bd63433050dd992037d848cf633eeec3119a502f93949dd9c0e1d664dca0ce33227f714393b8f3eef578e651ec3c7b8642af9d830cbbba
-
Filesize
22KB
MD5f4c006763ac0531c007e4cb8fd42c636
SHA1a44e6f076c95c6777e39375ec8e31224fce93fcb
SHA256cf44bd607393e7dbbf7efc70dfb2bb0b0511069202db5e8ae5243dfe84b006ab
SHA512a198944d582d7d2fe895f39a0884952f4976a8cc222e2047781ec89b453aaa6ecbddac2f2ea608d51f77ec66d48cddd809a55a052ed0b5620f8046483ee48b86
-
Filesize
22KB
MD5eb713c0495c9781e2e480762a323ee3e
SHA167cb899d90391a4d9c20a3c1ead05be23c2619ff
SHA25660d76b5355131a173bdca6d033d98a58837006ca2a60b675fb43aff4e352e907
SHA512ddcc381f8ed5a2f8fb7ab2d6c2e65b7358a09b9348e95c5bc9242a3dc8709418387c9c930f9391b4381860cc3eac3456d26bccc346ae87a1ea2760639f53050f
-
Filesize
110KB
MD59290e75408bf79683514752dc383dfe8
SHA1ac599e7b365354d2e26f1e648c77264f251cda3e
SHA256cf92d43d7f7ed621fe0ee0b0602030ca256d6b779b05e27d4518b5d1d9c0c2b6
SHA512f410d54b75cb5bc2ce63201c56373625b2489100b28edeb5cdaa59a34c0ff885311397b30e537b4f209786cf707e765bb7ebae93111f1f3c25e60d5fc762a7a2
-
Filesize
114KB
MD5eb12197d85f2af5169304632bb2f2fd8
SHA1601f5852407eaeee3b2123b9a5fd817d2408a52f
SHA2565769cc50fb47c8abd2a0d81810f79901ed26f40302de64092338fead98eb4cc9
SHA51225820a63d7cd855a6a030ca2d34c35ac30e27076c93367cc6314ba173849c0786df5b258496d1f1acb069155098d8b23d86aeac1c77673a83e09deeef194932b
-
Filesize
145KB
MD50800f524f3a2a754183460cd3f4523d5
SHA19126390777521520f163e09f4c797c8eccb59463
SHA256b86796590e9e091f778e934bfd9f2c60419be43388a410d389b93e85c9b2e462
SHA5124e18b96faa657d98ef69691acf97e13511c81fe41bab0de4aa13a8a5a505c99278d85c77720451b31285ea71797ba251282fac3223c51f80396033f764db7e9c
-
Filesize
4.9MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
3.3MB
-
Filesize
472KB
-
Filesize
112KB
-
Filesize
120KB
-
Filesize
300KB
-
Filesize
104KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
240KB
-
Filesize
216KB
-
Filesize
592KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
204KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB