Analysis
- max time kernel
2s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
03/02/2024, 05:03
General
- Target 8b77251f930fdf421bef43338fb37eda.exe
- Size 4.4MB
- Sample240203-fpqtgacbdr
- SHA256 1c26aa5bcb8e5bc2170d8c7b8c2b0698d4e8a60f0d0f65c1a9a3d5e9b360cf58
Malware Config
Extracted
-
metasploit
-
windows/single_exec
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 21 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b77251f930fdf421bef43338fb37eda.exe"C:\Users\Admin\AppData\Local\Temp\8b77251f930fdf421bef43338fb37eda.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\8b77251f930fdf421bef43338fb37eda.exe"C:\Users\Admin\AppData\Local\Temp\8b77251f930fdf421bef43338fb37eda.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /124-1243⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
injector.exe
injector.exe
csrss.exe
csrss.exe
memory/1376-33-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-29-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-42-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-41-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-40-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-39-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-38-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-20-0x0000000003000000-0x0000000003500000-memory.dmp
memory/1376-21-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-22-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-37-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-36-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-28-0x0000000003000000-0x0000000003500000-memory.dmp
memory/1376-35-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-30-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-31-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-32-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/1376-34-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/2532-1-0x0000000002E30000-0x000000000326D000-memory.dmp
memory/2532-2-0x0000000003270000-0x0000000003B96000-memory.dmp
memory/2532-3-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/2532-4-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/2532-6-0x0000000003270000-0x0000000003B96000-memory.dmp
memory/4012-8-0x0000000002FD0000-0x00000000038F6000-memory.dmp
memory/4012-17-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/4012-9-0x0000000000400000-0x00000000027D9000-memory.dmp
memory/4012-7-0x0000000002B90000-0x0000000002FCD000-memory.dmp