Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
13/04/2024, 08:26
General
- Target SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe
- Size 4.2MB
- Sample240413-kbvbyscd37
- SHA256 bfb49b198bec40507f48ae692234f001c7b0daf41c5efd93bbce37c3f9082e60
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 19 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 7 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ekwakfu5.ams.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
windefender.exe
memory/1564-283-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1564-277-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2964-103-0x0000000005680000-0x00000000059D4000-memory.dmp
memory/2964-119-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/2964-106-0x00000000707B0000-0x00000000707FC000-memory.dmp
memory/2964-108-0x0000000070930000-0x0000000070C84000-memory.dmp
memory/2964-107-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
memory/2964-118-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/2964-121-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/2964-93-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/2964-92-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/2964-91-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3436-3-0x0000000000400000-0x0000000003017000-memory.dmp
memory/3436-2-0x0000000005320000-0x0000000005C0B000-memory.dmp
memory/3436-1-0x0000000004F10000-0x0000000005312000-memory.dmp
memory/3436-52-0x0000000000400000-0x0000000003017000-memory.dmp
memory/3436-54-0x0000000005320000-0x0000000005C0B000-memory.dmp
memory/3840-28-0x000000007F660000-0x000000007F670000-memory.dmp
memory/3840-20-0x0000000006330000-0x0000000006684000-memory.dmp
memory/3840-47-0x0000000008070000-0x0000000008084000-memory.dmp
memory/3840-48-0x0000000008160000-0x000000000817A000-memory.dmp
memory/3840-49-0x00000000080B0000-0x00000000080B8000-memory.dmp
memory/3840-51-0x0000000074810000-0x0000000074FC0000-memory.dmp
memory/3840-45-0x0000000008020000-0x0000000008031000-memory.dmp
memory/3840-44-0x00000000080C0000-0x0000000008156000-memory.dmp
memory/3840-4-0x0000000003340000-0x0000000003376000-memory.dmp
memory/3840-5-0x0000000074810000-0x0000000074FC0000-memory.dmp
memory/3840-6-0x0000000005550000-0x0000000005560000-memory.dmp
memory/3840-7-0x0000000005B90000-0x00000000061B8000-memory.dmp
memory/3840-8-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/3840-9-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/3840-10-0x00000000061C0000-0x0000000006226000-memory.dmp
memory/3840-43-0x0000000008000000-0x000000000800A000-memory.dmp
memory/3840-46-0x0000000008060000-0x000000000806E000-memory.dmp
memory/3840-42-0x0000000007F10000-0x0000000007FB3000-memory.dmp
memory/3840-21-0x0000000006930000-0x000000000694E000-memory.dmp
memory/3840-40-0x0000000007EF0000-0x0000000007F0E000-memory.dmp
memory/3840-22-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/3840-23-0x0000000007910000-0x0000000007954000-memory.dmp
memory/3840-24-0x0000000007C70000-0x0000000007CE6000-memory.dmp
memory/3840-41-0x0000000005550000-0x0000000005560000-memory.dmp
memory/3840-30-0x0000000070850000-0x0000000070BA4000-memory.dmp
memory/3840-29-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/3840-27-0x0000000007EB0000-0x0000000007EE2000-memory.dmp
memory/3840-26-0x0000000007CF0000-0x0000000007D0A000-memory.dmp
memory/3840-25-0x0000000008370000-0x00000000089EA000-memory.dmp
memory/4184-288-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-291-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-297-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-276-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-279-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-282-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-285-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-294-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-269-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4184-259-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4204-274-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4280-105-0x0000000004CC0000-0x00000000050C1000-memory.dmp
memory/4280-122-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4280-136-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4280-56-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4280-158-0x0000000000400000-0x0000000003017000-memory.dmp
memory/4280-55-0x0000000004CC0000-0x00000000050C1000-memory.dmp
memory/4336-73-0x0000000070F70000-0x00000000712C4000-memory.dmp
memory/4336-83-0x0000000007A40000-0x0000000007AE3000-memory.dmp
memory/4336-57-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/4336-58-0x0000000005500000-0x0000000005510000-memory.dmp
memory/4336-59-0x0000000005500000-0x0000000005510000-memory.dmp
memory/4336-89-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/4336-86-0x0000000007DB0000-0x0000000007DC4000-memory.dmp
memory/4336-85-0x0000000007D60000-0x0000000007D71000-memory.dmp
memory/4336-84-0x0000000005500000-0x0000000005510000-memory.dmp
memory/4336-69-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/4336-72-0x00000000707B0000-0x00000000707FC000-memory.dmp
memory/4336-71-0x000000007F0F0000-0x000000007F100000-memory.dmp
memory/4336-70-0x0000000006840000-0x000000000688C000-memory.dmp
memory/5112-137-0x000000007F2A0000-0x000000007F2B0000-memory.dmp
memory/5112-132-0x0000000005DF0000-0x0000000006144000-memory.dmp
memory/5112-133-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/5112-134-0x0000000004E70000-0x0000000004E80000-memory.dmp