Analysis

  • max time kernel
    189s
  • max time network
    215s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 19:28

General

  • Target

    3f5f47f94636eacc13159b402ede3483231d0b69ea137e773191c1dee1025d72.exe

  • Size

    4.2MB

  • MD5

    fde8a5ce7cf63cc996ebe0395d63f005

  • SHA1

    cdc2b2a3b1b3466fbe26c1187c8d1eaf7e50255f

  • SHA256

    3f5f47f94636eacc13159b402ede3483231d0b69ea137e773191c1dee1025d72

  • SHA512

    19fc5e6cf2b50a9c934444572175c732157df5c1b0e7d2a8c70272474cb2d84d2c39fcace3879ddefe4258134e420c663a8c8f52397706ebba749815eb49e07b

  • SSDEEP

    98304:Tz8muvG4/7oo98xMphVIqHAQJ7eNfIWzS5gC960Xfu6ti9vBy29w:TzvuvT/7/zVIWAQdeNfIWzX0W6tA42m

Score
10/10

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f5f47f94636eacc13159b402ede3483231d0b69ea137e773191c1dee1025d72.exe
    "C:\Users\Admin\AppData\Local\Temp\3f5f47f94636eacc13159b402ede3483231d0b69ea137e773191c1dee1025d72.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3756

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y4ucm3iy.gfk.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/2216-2-0x0000000005120000-0x0000000005A0B000-memory.dmp

          Filesize

          8.9MB

        • memory/2216-3-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-4-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-5-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-6-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-7-0x0000000004D10000-0x0000000005115000-memory.dmp

          Filesize

          4.0MB

        • memory/2216-8-0x0000000005120000-0x0000000005A0B000-memory.dmp

          Filesize

          8.9MB

        • memory/2216-9-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-63-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-10-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-39-0x0000000000400000-0x000000000310E000-memory.dmp

          Filesize

          45.1MB

        • memory/2216-1-0x0000000004D10000-0x0000000005115000-memory.dmp

          Filesize

          4.0MB

        • memory/3756-30-0x0000000006770000-0x000000000678E000-memory.dmp

          Filesize

          120KB

        • memory/3756-41-0x0000000007C10000-0x0000000007C86000-memory.dmp

          Filesize

          472KB

        • memory/3756-17-0x0000000005800000-0x0000000005822000-memory.dmp

          Filesize

          136KB

        • memory/3756-18-0x00000000058A0000-0x0000000005906000-memory.dmp

          Filesize

          408KB

        • memory/3756-19-0x0000000005910000-0x0000000005976000-memory.dmp

          Filesize

          408KB

        • memory/3756-13-0x0000000074600000-0x0000000074DB0000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-25-0x0000000006140000-0x0000000006494000-memory.dmp

          Filesize

          3.3MB

        • memory/3756-14-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-31-0x0000000006990000-0x00000000069DC000-memory.dmp

          Filesize

          304KB

        • memory/3756-32-0x0000000006E50000-0x0000000006E94000-memory.dmp

          Filesize

          272KB

        • memory/3756-34-0x0000000074600000-0x0000000074DB0000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-36-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-35-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-38-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-12-0x0000000005A10000-0x0000000006038000-memory.dmp

          Filesize

          6.2MB

        • memory/3756-15-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-44-0x00000000053D0000-0x00000000053E0000-memory.dmp

          Filesize

          64KB

        • memory/3756-46-0x0000000008310000-0x000000000898A000-memory.dmp

          Filesize

          6.5MB

        • memory/3756-47-0x00000000013C0000-0x00000000013DA000-memory.dmp

          Filesize

          104KB

        • memory/3756-48-0x000000007F720000-0x000000007F730000-memory.dmp

          Filesize

          64KB

        • memory/3756-49-0x0000000007D10000-0x0000000007D42000-memory.dmp

          Filesize

          200KB

        • memory/3756-50-0x00000000704A0000-0x00000000704EC000-memory.dmp

          Filesize

          304KB

        • memory/3756-51-0x0000000070C40000-0x0000000070F94000-memory.dmp

          Filesize

          3.3MB

        • memory/3756-61-0x0000000007E30000-0x0000000007E4E000-memory.dmp

          Filesize

          120KB

        • memory/3756-62-0x0000000007E50000-0x0000000007EF3000-memory.dmp

          Filesize

          652KB

        • memory/3756-11-0x0000000005310000-0x0000000005346000-memory.dmp

          Filesize

          216KB

        • memory/3756-66-0x0000000007B90000-0x0000000007B9A000-memory.dmp

          Filesize

          40KB

        • memory/3756-67-0x0000000008050000-0x00000000080E6000-memory.dmp

          Filesize

          600KB

        • memory/3756-69-0x0000000007E10000-0x0000000007E21000-memory.dmp

          Filesize

          68KB

        • memory/3756-70-0x000000007F720000-0x000000007F730000-memory.dmp

          Filesize

          64KB