Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/02/2024, 13:17
General
- Target SecuriteInfo.com.Win32.PWSX-gen.24442.12778.exe
- Size 4.0MB
- Sample240220-qjcprshd79
- SHA256 c6c0b46b99ca7a4e1bc4d7969fc055721c1f3be10b618db6b1427f1e6b8f65be
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 21 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 7 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24442.12778.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24442.12778.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24442.12778.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24442.12778.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hxkkleg3.cjp.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
csrss.exe
windefender.exe
memory/1436-269-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-280-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-277-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-286-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-274-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-223-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-290-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-293-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-271-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-259-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1436-283-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-93-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-110-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-156-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-150-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-59-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1892-95-0x0000000002A30000-0x0000000002E37000-memory.dmp
memory/1892-57-0x0000000002A30000-0x0000000002E37000-memory.dmp
memory/3000-268-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3132-23-0x00000000076D0000-0x0000000007714000-memory.dmp
memory/3132-49-0x0000000007CB0000-0x0000000007CC4000-memory.dmp
memory/3132-50-0x0000000007CF0000-0x0000000007D0A000-memory.dmp
memory/3132-51-0x0000000007CE0000-0x0000000007CE8000-memory.dmp
memory/3132-48-0x0000000007C90000-0x0000000007C9E000-memory.dmp
memory/3132-55-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3132-47-0x0000000007C60000-0x0000000007C71000-memory.dmp
memory/3132-46-0x0000000007D50000-0x0000000007DE6000-memory.dmp
memory/3132-45-0x0000000007AB0000-0x0000000007ABA000-memory.dmp
memory/3132-44-0x0000000007B30000-0x0000000007BD3000-memory.dmp
memory/3132-43-0x0000000007AD0000-0x0000000007AEE000-memory.dmp
memory/3132-33-0x000000007F2D0000-0x000000007F2E0000-memory.dmp
memory/3132-32-0x0000000070680000-0x00000000709D4000-memory.dmp
memory/3132-30-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/3132-29-0x0000000007AF0000-0x0000000007B22000-memory.dmp
memory/3132-27-0x0000000007930000-0x000000000794A000-memory.dmp
memory/3132-26-0x0000000007F90000-0x000000000860A000-memory.dmp
memory/3132-25-0x0000000007890000-0x0000000007906000-memory.dmp
memory/3132-24-0x0000000005200000-0x0000000005210000-memory.dmp
memory/3132-22-0x0000000006610000-0x000000000665C000-memory.dmp
memory/3132-21-0x0000000006590000-0x00000000065AE000-memory.dmp
memory/3132-20-0x0000000005F30000-0x0000000006284000-memory.dmp
memory/3132-10-0x0000000005790000-0x00000000057F6000-memory.dmp
memory/3132-9-0x0000000005710000-0x0000000005776000-memory.dmp
memory/3132-8-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/3132-7-0x0000000005840000-0x0000000005E68000-memory.dmp
memory/3132-6-0x0000000002EE0000-0x0000000002F16000-memory.dmp
memory/3132-5-0x0000000005200000-0x0000000005210000-memory.dmp
memory/3132-4-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3144-77-0x0000000070700000-0x0000000070A54000-memory.dmp
memory/3144-92-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3144-61-0x0000000003510000-0x0000000003520000-memory.dmp
memory/3144-62-0x0000000003510000-0x0000000003520000-memory.dmp
memory/3144-68-0x0000000006320000-0x0000000006674000-memory.dmp
memory/3144-74-0x0000000003510000-0x0000000003520000-memory.dmp
memory/3144-76-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/3144-60-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3144-75-0x000000007F5D0000-0x000000007F5E0000-memory.dmp
memory/3144-87-0x0000000007B70000-0x0000000007C13000-memory.dmp
memory/3144-88-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/3144-89-0x0000000007EE0000-0x0000000007EF4000-memory.dmp
memory/4744-109-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/4744-96-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/4744-97-0x0000000005480000-0x0000000005490000-memory.dmp
memory/4744-108-0x0000000006430000-0x0000000006784000-memory.dmp
memory/4744-111-0x00000000700E0000-0x0000000070434000-memory.dmp
memory/4744-112-0x000000007EFB0000-0x000000007EFC0000-memory.dmp
memory/4744-123-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/4796-31-0x0000000002D40000-0x000000000313B000-memory.dmp
memory/4796-28-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/4796-3-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/4796-2-0x0000000003140000-0x0000000003A2B000-memory.dmp
memory/4796-1-0x0000000002D40000-0x000000000313B000-memory.dmp
memory/4796-52-0x0000000003140000-0x0000000003A2B000-memory.dmp
memory/4796-58-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/4832-272-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4832-278-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4880-140-0x00000000700E0000-0x0000000070434000-memory.dmp
memory/4880-139-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/4880-138-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/4880-127-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/4880-126-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/4880-125-0x00000000740C0000-0x0000000074870000-memory.dmp