Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 02:41
General
-
Target
5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb.exe
-
Size
4.2MB
-
MD5
90c2c0a3850e702555c86672dfccf87e
-
SHA1
547237f6c49839d5b52c21541e3ef97e70c09e14
-
SHA256
5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb
-
SHA512
bef33bcfe5c99260d7e3d4a1f874606b166a8ee6307780140ce3350df0e1c7804695596fdcd252a9ce5445439afc2bb6a8b33d99bf175fb722f89213197367f9
-
SSDEEP
98304:teW8UzsHIbLf9dWRHWVRhdNR5S1sJRNc/DhpLv/dFcsAkZ5X:q0L1dWRH6Rb9w/n3rVAk3
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 19 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 17 IoCs
-
Detects executables Discord URL observed in first stage droppers 17 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 17 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 17 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 17 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb.exe"C:\Users\Admin\AppData\Local\Temp\5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb.exe"C:\Users\Admin\AppData\Local\Temp\5d60502a5cb4d285aa1292f7d1fd6297e07e310babf6fc52bcdc86ef0c9e06bb.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 9722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3888 -ip 38881⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
19KB
MD5cc4873959d4035605fdfaf59d4d48687
SHA16bc30972cbf4818feb72ba04dcac013ab881ea36
SHA25686c73b10da5d96e9cd75862d97a466583f8567a3c3aa750474bb32e65a66872f
SHA512eb38c75098b8d06f18207e0b00063609755b367350a335ea40fc18714896b2210ed136f1a4de2f242dc4612243b845cf7a2efd94e809a9156e3083cb4d008df8
-
Filesize
19KB
MD515ba1e0c24c80b36028e68481de93ae4
SHA198b9afd9152e3532c78dc493405359bf1fd60253
SHA2566ee964cf084023fe96cdfe07bf855f5cbdb73ffdd7d785ce3a857d77e494ff32
SHA512cfd85c659509c250123341cdc4529713cd046009d53cf88020c83faa0f2783cb2c234420a1546232654993371aeb55aef3b21f8a8b9d6111876d1ad39b0d8cfa
-
Filesize
19KB
MD548353a4be1b3810f0ac023d0d475d51b
SHA17b5051d45124b08e7e13d0203c8692b7d0e0cbf5
SHA256acbc23fbd60211b1a203537f9020a8ff5065823e7c403703ebbd408eb09d7f6b
SHA512b0218416e7fe69e8a3b086fb75ebabdcc60c04cf02d9127e94ab1a587584868b3d65990f26e6547e7a9e04c209e4310b5166c12c72247091d992b3ae2e760254
-
Filesize
19KB
MD591c7f6d6d61a4e30bab52dfb49b754ec
SHA161cd516d6ae7dab695022161261e2c73747e5e83
SHA25633a89651130820f0ce1904fc93c2594ca240df7b1b8e40e11997ac9f55e0c5c6
SHA512174a88770f0b9c302cc460c6aba30b89ca48bfd2cf37bd3f151e2abe478e71c1d539fbbf9c5d6543cf9316ac737720caba2a47de193190c21f294df8554c17ea
-
Filesize
19KB
MD5a6b663d6380a1790dd71a4efcb598565
SHA1f93775699acf1b5c370d97590aeff63964eb47a5
SHA256c29447aee42e042e4d2fa48d0755c9eaf7407aee73900c85b0a1df8aec9bcc4b
SHA512e9217d3a0902629227715613e18dccee52d7154683f6f3ffd000cf97ad940794d81477feee89bbafe2a5e72de63a8c716c746aa51382da4ff7f576a8ec50aef6
-
Filesize
3.2MB
MD50740d51a779d518162897271762a0e91
SHA11129e80b31a206640b5a4716af15678849134923
SHA2568a39fee149243e83526fddb18b9230abbaaab5a79fbf570f4ba173bf564fc034
SHA512b2a2e2f0c963b6660d2a7c20ff1812b3627f8282fbb67c44861bb83a1e2475371aede1942eff099116e0645d5db3ad56376b4f89474694de4d1c48df5eb9d05d
-
Filesize
3.1MB
MD574325f5dc4f87a1a62c80ec1669f14d0
SHA1a9713d10148ff2be2d01e15a79d5e3ca90cebb6c
SHA256fa48998ce70382225aa056df42af74f5df635a53db668d6bceb9fb713cdad223
SHA5123fecea2fde9bfccdf79e1343eff70b59d1c8a439ed04df30183ddcf25ffa6fda9d6be0d0e282e3e52f977b37b242e80a74a5ff2c6aab52412703caf6f416cee7
-
Filesize
1.2MB
MD5a43d1181c5c818d7d78e782ec1828903
SHA1ce87b6b09f2b30c85a2420d7e1471a0c2db55475
SHA25657b26db83b472d3aa74fdc739ae2a2aab69513a334cc9850d2adc81053093cf4
SHA5125985d550e97d5a383a3b121dd3c42ef032f3815afa7ac6ff35c0935fb143c51c5ac0406b0dd854c1936aff98d8da964ba1c390187b81380ee891ac8708cdd6d4
-
Filesize
1.1MB
MD589541e531df990a01fc041b4608bd26b
SHA18f46a92c37e16c9057b6266f2209c76466428e91
SHA256b11a544f0fa080cfdbd0e561213a75eef4cb1c6393e1b87b24f2e661b4e0e71b
SHA51245a0e2f53b1a71900485c0829dda9f56c97bc0fc6911fb040ad1f0b8aacaa29123451427e1f88618f1d48da4f16e85761fcfc971bfd7980cc06f7aedc4d62543
-
Filesize
1.1MB
MD5c1df4db48316b61e1de2f103187d2b9a
SHA1cbc5bfd7969eb45644e8293913469fa4739def15
SHA25690032cc8c3e54a63b1ca3de0a3003c49d17d7a46881550c85e55258768dd506d
SHA512413f7b9634e5232b3de82e54c9892607299ea971c1830d0ef71c4665bb16c0a2ceefcee566f16d84470c3f1fc87be9bc488d2c16e8db582b87bc518c98db8248
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
272KB
-
Filesize
472KB
-
Filesize
4.9MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
26.1MB
-
Filesize
4.0MB
-
Filesize
26.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
26.1MB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
68KB