Analysis
-
max time kernel
3s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe
Resource
win10v2004-20240412-en
General
-
Target
267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe
-
Size
4.2MB
-
MD5
75fae659377cebf89cf61e90c45f24f2
-
SHA1
362fd4d7a74226cc703ed73a9ece0571e86ab2a5
-
SHA256
267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2
-
SHA512
a4cd447eaa6d2e46353c6ec8b6c476400c6b73961103637b03f2d269b52dd25879c6648737dd4ac6d65118cbe6d6f2d410b3172f1647abaf7380a0d266ab36f5
-
SSDEEP
98304:G+HT2dFOlkJa7jNZC2ePu9ILkthheCYlOaP:/zMKBrC2kuA8hntQ
Malware Config
Signatures
-
Glupteba payload 21 IoCs
resource yara_rule behavioral1/memory/4532-2-0x0000000005260000-0x0000000005B4B000-memory.dmp family_glupteba behavioral1/memory/4532-3-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4532-54-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4532-57-0x0000000005260000-0x0000000005B4B000-memory.dmp family_glupteba behavioral1/memory/2148-59-0x00000000051A0000-0x0000000005A8B000-memory.dmp family_glupteba behavioral1/memory/4532-60-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/2148-71-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/2148-122-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/2148-153-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-250-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-257-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-262-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-265-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-268-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-271-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-274-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-277-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-280-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-283-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-286-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/4612-289-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5116 netsh.exe -
resource yara_rule behavioral1/files/0x0009000000023409-254.dat upx behavioral1/memory/4496-260-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/904-263-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/904-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1800 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 448 schtasks.exe 2356 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe"C:\Users\Admin\AppData\Local\Temp\267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe"1⤵PID:4532
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:5056
-
-
C:\Users\Admin\AppData\Local\Temp\267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe"C:\Users\Admin\AppData\Local\Temp\267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2.exe"2⤵PID:2148
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3296
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:3672
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:5116
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:4216
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:4468
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:4612
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:2444
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:448
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3884
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:388
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:3904
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:2656
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2356
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4496
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2976
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:1800
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD531fd06e7b123ecdc15fc62495a23372f
SHA13063a580d32f6854b01370874070ee95bc7c1ea9
SHA25629bacde39ee25e4eb5357459939204418658274508d2f22b89849225e955f793
SHA5126208008d990b7a2d90795496f846e8a6c34bd3ee2e003ba05a428ce2a6d7ec4a87684d128d12d9e71aca86717c9670aa48c20f2db79f7560b478c2ac52e2ddd6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59ba611c9b1856947367846be9bc4408b
SHA1463c57d228bd7c8a245e7fb175013aa18f5884e0
SHA2567aff54e1366bfd18f8ed67d164664a72c210b736352feee787e1a5406c0254a0
SHA512992c6598c18d54779d19cc45448934d91496fd445d1597d29c912bf161df1632a3bfd10e5d469b15cf03bdf12f34ef79b5c07208280c0129f358d33ee88b9b3c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD502562f128b5007a3b7b930a313614e3c
SHA1497541260a2794d24113aac46631b43bbd7f03fc
SHA256d7fe4c8c53e6ddeb44c4b14797f93d0a611ef4d7c47abe77b74b2cf8103771bd
SHA512f445891eefdc28d5327127c4f0ebfee351cde59db3dcd4e7565a579c24e91ac82d194a5c5da3caab8220dca48ed1ff8be5bf2c5080df1ba5e9e77b715dfadf71
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5bc16e3c01b56f08d21b5c07e761c70a4
SHA14fb22b238155ac69e70ac17cf3e36daa7687bf47
SHA25628267c07403084c44261f29f4e53abe9fb4c762a24795919e09326e21ba69e2d
SHA512e57df8bb93973ca4ee196c8ffedef57c7f096357732831d8f968296da4eb7257a048261aff25cb01c0a56863456b4c67490d95e1eec5becf62935aabd670fb8f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD584123a90f4ddbf0ac09cafd723184fdb
SHA1ac17a14c53d42a84e9b7b6f1e5f9bba95449e7cb
SHA256fa5aecdb60b5ee702ee24318cbf903565fe4f625b916be19345a7cf896d3c32f
SHA512a82ff6078f5118162dac37e2c399b0e3e09dbbb537c9836bf5b09afb016941aa9698f2cb1e8c2ca0f2b75f0c11fb87bf30abf6eb7bf46d27314a970895608d8c
-
Filesize
4.2MB
MD575fae659377cebf89cf61e90c45f24f2
SHA1362fd4d7a74226cc703ed73a9ece0571e86ab2a5
SHA256267f3218865962c91c69db8eba6d5f5e0c0f14d8074d25e5f7684701dc6878e2
SHA512a4cd447eaa6d2e46353c6ec8b6c476400c6b73961103637b03f2d269b52dd25879c6648737dd4ac6d65118cbe6d6f2d410b3172f1647abaf7380a0d266ab36f5
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec