Analysis
-
max time kernel
0s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/04/2024, 19:22
Static task
static1
Behavioral task
behavioral1
Sample
712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe
Resource
win10v2004-20240412-en
General
-
Target
712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe
-
Size
4.2MB
-
MD5
9d8241c7b6f599e319dd0916d7d16cda
-
SHA1
372359a86bb54c62a41c2ae6efa77b9220a2bb8e
-
SHA256
712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb
-
SHA512
65770159f57ceab1556d8493496090985f1a9baf95a3ec5ff33a670bccc36898b7a579a2cebc34b9e56e21f88f8b073bb0d63b9e257497e516a47b095f7b7ee7
-
SSDEEP
98304:jz8muvG4/7oo98xMphVIqHAQJ7eNfIWzS5gC960Xfu6ti9vBy29T:jzvuvT/7/zVIWAQdeNfIWzX0W6tA421
Malware Config
Signatures
-
Glupteba payload 17 IoCs
resource yara_rule behavioral2/memory/3848-2-0x0000000005360000-0x0000000005C4B000-memory.dmp family_glupteba behavioral2/memory/3848-3-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/2172-62-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/3848-63-0x0000000005360000-0x0000000005C4B000-memory.dmp family_glupteba behavioral2/memory/3848-67-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/2172-207-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-242-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-253-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-257-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-261-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-265-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-269-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-273-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-277-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-289-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-293-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral2/memory/4656-297-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4316 netsh.exe -
resource yara_rule behavioral2/files/0x000200000002aa0a-247.dat upx behavioral2/memory/4936-250-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4768-255-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4768-263-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1388 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4316 schtasks.exe 4876 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe"C:\Users\Admin\AppData\Local\Temp\712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe"1⤵PID:3848
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:1356
-
-
C:\Users\Admin\AppData\Local\Temp\712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe"C:\Users\Admin\AppData\Local\Temp\712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb.exe"2⤵PID:2172
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:5040
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:2564
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4316
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:5092
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3448
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:4656
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:3292
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4876
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4692
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:5036
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4316
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4936
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:4776
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:1388
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:4768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD590e1e813cc0227916075319b7707dcb8
SHA13ae6173e84c33a960859ebc7bbba3bcbf393d45f
SHA2565826f80d84f44eb4d1004c498146d682b129481b8cf913bc3f186aa6a56bc01e
SHA512c2f5148ab4b853dcb8a9ef6469d215a6315085b86210ad15d0cd52b6c331f0ecc6c60801bfb36a1c73312a09832b607fdfe42593e477c935e48023719f5029aa
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56ef055286d20c889484859efa8861232
SHA1cf9dab6537882ebb548a237b57975a543e865813
SHA2562e1df5f8857dc9e4265e2f76f957d599436127d68a1b4ad6fc8dbad137a5b7e5
SHA51260bcd02f12c2004fc0534884b8a86947aa7290100c6f2b06da8d75afd2f7d7986b2e32cedaa3df2445463dccdc8cefd9d4138062d0cbcf07a406ca7e49670f94
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52276e87c2d46cc6421f43280f0d0e5e7
SHA15b4483a16c355fcdd06072ca15eb5a35c41cb05c
SHA256a8453c806454d6a783582c4ff42b1962cffc2025d683cbf72526aa440a8e930b
SHA5120c4a6a9b695d12134cf891dc11471b7fc8338eccb044b8f986c0afffcda5f2c280cb9dea24550c1c79821da539df9a60a98aea1c40a935523ea26f0815fd32c1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5bf61719112e848fc24f8966c0d6d71f1
SHA19fd11f78297d132f660f877d8549adb689697d9c
SHA256e631cb316967825550ef36e7da545f443d600b9f017bf7995c734008d94b487e
SHA512bfa3781fabde78d980b1686959c6e171d73b69d4a5dfbaa7c1fbcd65f411ca68a43bd1ca4b3c6886030bfeb032179072a2fbf84708baca7a6ababb2fb439dfea
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d593c25916fddd6d12cb11eef10008ae
SHA1b408ec4f7b6dca5566fac56f394af9064a996245
SHA25686c72a99e0997a12c0a6bb8edc445919a6aae2744117c96ffc8c2d39a610b94b
SHA51287dff7c43c0c1092c692d855acb1f97f976fce7cb6c1a0bc4aea66bade9295bc57adb3e137baf3ab477625e472d681a938c3eff6888650813432805237a55263
-
Filesize
4.2MB
MD59d8241c7b6f599e319dd0916d7d16cda
SHA1372359a86bb54c62a41c2ae6efa77b9220a2bb8e
SHA256712852d297ba33f4216b1487ce939f367a7aa98dd849f81d3d30d4bae08a13fb
SHA51265770159f57ceab1556d8493496090985f1a9baf95a3ec5ff33a670bccc36898b7a579a2cebc34b9e56e21f88f8b073bb0d63b9e257497e516a47b095f7b7ee7
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec