Analysis

  • max time kernel
    160s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 20:03

General

  • Target

    5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0.exe

  • Size

    4.2MB

  • MD5

    8ba9f36b143b917aeae7d4ea738a4db1

  • SHA1

    5ce026af13ed8e5d1895aa4465e6e1c2fa573e8d

  • SHA256

    5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0

  • SHA512

    15c6b80729c77ba21400b670c55fd0c1b28dd2f1823abc804b32da9f7494fe372701bc0885339b03430b92f4a58eaace22c06c3653246c7a2204c9720dcfdc82

  • SSDEEP

    98304:ZU4Iq03aI5N3yqqHwBEspKQ2DvCGo03KUue+Tq:rIh7By/QBEsp+2hnfq

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 16 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0.exe
    "C:\Users\Admin\AppData\Local\Temp\5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1052
    • C:\Users\Admin\AppData\Local\Temp\5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0.exe
      "C:\Users\Admin\AppData\Local\Temp\5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2908
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:1044
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4956
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1564
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3584
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3444
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:5036
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4020
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4452

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0h5mvcce.yvm.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

            Filesize

            35KB

            MD5

            c0c4404d7fa40cfc426fa66648e532c2

            SHA1

            d60dcafc42c6cca766a81d5bfdd8e86978940db0

            SHA256

            ca8746b989ce25d54f1b7fa117f804f162d842228b7f6e9422aeaf0cc6a017f3

            SHA512

            c84bb02966316ee10a38f35516964e4b2730a4a36ede9e13e8b3cf8669756dc7ed44fa5d06e30347050b854e6f82219a38db13dce3b16138354aa331c73d02b9

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            1b429ce2aa832b6945b82ac67163f673

            SHA1

            0ea8a41bde430b6cce7ffc8996c14477d364524f

            SHA256

            b3d7fdde4afe5c9d1aae1f3a4a3dae71ffb9ef5824a978249d51576ecf2e1069

            SHA512

            9aa52ab21a920bc1798ea2d1de60a80a9ec90963f09ec147383fb096843c650269c19c56abe10bf04009274b1e1d2efb04cba2359c94a012f1344f9010236b2f

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            43fbaa16e31175b3a39778ba4f2b6bd4

            SHA1

            ac246a857c8c706da11ab058fecfc365ccd7c46b

            SHA256

            d55b58347a01003908c43c78e7ac9cd86c59411a4041647b5255f573390828f2

            SHA512

            1d69c4aae9800b4f9cf4e4987dd4211ea9719f67db5ea65ff148f72cc52a4450fc4b29705011cfbb14685e6faaea4fb4fd26e3123a81c0f24ca025ceb7b5e754

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            22b97b13a9d669fb7f9c693a58d879ce

            SHA1

            94d67eeb3bbd99d292f2ebda65fcd7c7ea403b38

            SHA256

            278ff1ef9b07c35e1e1c157c149565340d195821c1fdf26e8ff24e1d9090125b

            SHA512

            693c27c3b48bef5dac7245c776299d7582506a7735e5f3e4cecf4016df2b79dd58589358a8e07ee23baa6ec61ecfce659d1b7b0595e49c131f5e541d297865c0

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            834818a476d4a3b191fe8aa586ca7f17

            SHA1

            223bac1f69dee9c812f57cea77ef1f450558960e

            SHA256

            548604b3c35bc5cadf5182215265397b8026967f99952ff6e9c30b57cee5070d

            SHA512

            61d9b3f1ab63b56ef34b7178cf8972ea7fb340e59eb601c4eaae9d4d56326d0a1dbea28b52e3ac8236af8b34d7c81d9eb84b20faaef93905b42ebc3380223de6

          • C:\Windows\rss\csrss.exe

            Filesize

            4.2MB

            MD5

            8ba9f36b143b917aeae7d4ea738a4db1

            SHA1

            5ce026af13ed8e5d1895aa4465e6e1c2fa573e8d

            SHA256

            5b244711ca1d9cf6a32e4907ee7da31d148d48e35559cc1dffcf5c1f76a0f2d0

            SHA512

            15c6b80729c77ba21400b670c55fd0c1b28dd2f1823abc804b32da9f7494fe372701bc0885339b03430b92f4a58eaace22c06c3653246c7a2204c9720dcfdc82

          • memory/956-31-0x0000000005320000-0x0000000005C0B000-memory.dmp

            Filesize

            8.9MB

          • memory/956-4-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/956-3-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/956-2-0x0000000005320000-0x0000000005C0B000-memory.dmp

            Filesize

            8.9MB

          • memory/956-64-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/956-62-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/956-1-0x0000000004F20000-0x000000000531F000-memory.dmp

            Filesize

            4.0MB

          • memory/956-51-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/956-26-0x0000000004F20000-0x000000000531F000-memory.dmp

            Filesize

            4.0MB

          • memory/956-45-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/1052-61-0x0000000004AF0000-0x0000000004B00000-memory.dmp

            Filesize

            64KB

          • memory/1052-9-0x00000000050E0000-0x0000000005102000-memory.dmp

            Filesize

            136KB

          • memory/1052-30-0x0000000007390000-0x00000000073AA000-memory.dmp

            Filesize

            104KB

          • memory/1052-28-0x00000000072E0000-0x0000000007356000-memory.dmp

            Filesize

            472KB

          • memory/1052-32-0x0000000007560000-0x0000000007592000-memory.dmp

            Filesize

            200KB

          • memory/1052-33-0x0000000070A60000-0x0000000070AAC000-memory.dmp

            Filesize

            304KB

          • memory/1052-34-0x0000000071160000-0x00000000714B4000-memory.dmp

            Filesize

            3.3MB

          • memory/1052-44-0x0000000007540000-0x000000000755E000-memory.dmp

            Filesize

            120KB

          • memory/1052-27-0x0000000004AF0000-0x0000000004B00000-memory.dmp

            Filesize

            64KB

          • memory/1052-46-0x000000007F690000-0x000000007F6A0000-memory.dmp

            Filesize

            64KB

          • memory/1052-47-0x00000000075A0000-0x0000000007643000-memory.dmp

            Filesize

            652KB

          • memory/1052-48-0x0000000007530000-0x000000000753A000-memory.dmp

            Filesize

            40KB

          • memory/1052-49-0x0000000007760000-0x00000000077F6000-memory.dmp

            Filesize

            600KB

          • memory/1052-50-0x00000000076C0000-0x00000000076D1000-memory.dmp

            Filesize

            68KB

          • memory/1052-24-0x0000000006F20000-0x0000000006F64000-memory.dmp

            Filesize

            272KB

          • memory/1052-52-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

          • memory/1052-53-0x0000000004AF0000-0x0000000004B00000-memory.dmp

            Filesize

            64KB

          • memory/1052-55-0x0000000007700000-0x000000000770E000-memory.dmp

            Filesize

            56KB

          • memory/1052-56-0x0000000007710000-0x0000000007724000-memory.dmp

            Filesize

            80KB

          • memory/1052-57-0x0000000007800000-0x000000000781A000-memory.dmp

            Filesize

            104KB

          • memory/1052-58-0x0000000007750000-0x0000000007758000-memory.dmp

            Filesize

            32KB

          • memory/1052-23-0x00000000060B0000-0x00000000060FC000-memory.dmp

            Filesize

            304KB

          • memory/1052-63-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

          • memory/1052-22-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

            Filesize

            120KB

          • memory/1052-21-0x00000000059A0000-0x0000000005CF4000-memory.dmp

            Filesize

            3.3MB

          • memory/1052-6-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

          • memory/1052-5-0x0000000004A20000-0x0000000004A56000-memory.dmp

            Filesize

            216KB

          • memory/1052-7-0x0000000004AF0000-0x0000000004B00000-memory.dmp

            Filesize

            64KB

          • memory/1052-8-0x0000000005130000-0x0000000005758000-memory.dmp

            Filesize

            6.2MB

          • memory/1052-29-0x00000000079E0000-0x000000000805A000-memory.dmp

            Filesize

            6.5MB

          • memory/1052-10-0x00000000057D0000-0x0000000005836000-memory.dmp

            Filesize

            408KB

          • memory/1052-16-0x00000000058F0000-0x0000000005956000-memory.dmp

            Filesize

            408KB

          • memory/1564-140-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/2908-81-0x0000000006760000-0x00000000067AC000-memory.dmp

            Filesize

            304KB

          • memory/2908-102-0x00000000011F0000-0x0000000001200000-memory.dmp

            Filesize

            64KB

          • memory/2908-84-0x0000000070B60000-0x0000000070BAC000-memory.dmp

            Filesize

            304KB

          • memory/2908-96-0x0000000007430000-0x00000000074D3000-memory.dmp

            Filesize

            652KB

          • memory/2908-97-0x0000000007700000-0x0000000007711000-memory.dmp

            Filesize

            68KB

          • memory/2908-70-0x00000000011F0000-0x0000000001200000-memory.dmp

            Filesize

            64KB

          • memory/2908-100-0x0000000007750000-0x0000000007764000-memory.dmp

            Filesize

            80KB

          • memory/2908-101-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/2908-69-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/2908-105-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/2908-83-0x00000000011F0000-0x0000000001200000-memory.dmp

            Filesize

            64KB

          • memory/2908-71-0x0000000005B70000-0x0000000005EC4000-memory.dmp

            Filesize

            3.3MB

          • memory/2908-85-0x0000000071300000-0x0000000071654000-memory.dmp

            Filesize

            3.3MB

          • memory/3240-68-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-82-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-139-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-106-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-172-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-67-0x0000000004D20000-0x0000000005123000-memory.dmp

            Filesize

            4.0MB

          • memory/3240-98-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3240-95-0x0000000004D20000-0x0000000005123000-memory.dmp

            Filesize

            4.0MB

          • memory/3584-211-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/3584-178-0x0000000000400000-0x0000000003118000-memory.dmp

            Filesize

            45.1MB

          • memory/4956-122-0x0000000004910000-0x0000000004920000-memory.dmp

            Filesize

            64KB

          • memory/4956-138-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/4956-136-0x0000000006350000-0x0000000006364000-memory.dmp

            Filesize

            80KB

          • memory/4956-126-0x0000000071300000-0x0000000071654000-memory.dmp

            Filesize

            3.3MB

          • memory/4956-125-0x0000000070B60000-0x0000000070BAC000-memory.dmp

            Filesize

            304KB

          • memory/4956-124-0x000000007FC70000-0x000000007FC80000-memory.dmp

            Filesize

            64KB

          • memory/4956-110-0x0000000004910000-0x0000000004920000-memory.dmp

            Filesize

            64KB

          • memory/4956-109-0x0000000074C60000-0x0000000075410000-memory.dmp

            Filesize

            7.7MB

          • memory/4956-111-0x0000000004910000-0x0000000004920000-memory.dmp

            Filesize

            64KB