Analysis

  • max time kernel
    16s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/04/2024, 20:03

General

  • Target

    71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe

  • Size

    4.2MB

  • MD5

    62dc86ed5cec63e5ccb959c407a4a591

  • SHA1

    2070a84ba529d62ee28745bbc5c810bfbb9b721c

  • SHA256

    71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1

  • SHA512

    de79eeef9db2c8ffc50fc843a397f3bd48d61a52287ecc13ab32093a4405bf3c338cb87f4bf71f76c1e7e6e30dca6a4cc683657009558ff6b7ac11295884dc3c

  • SSDEEP

    98304:RU4Iq03aI5N3yqqHwBEspKQ2DvCGo03KUue+TU:DIh7By/QBEsp+2hnfU

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 14 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe
    "C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2224
    • C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe
      "C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:768
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3884
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        PID:4800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1448
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1492
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3620
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2752
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3388
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
              PID:784
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:2576
            • C:\Windows\windefender.exe
              "C:\Windows\windefender.exe"
              4⤵
                PID:1904
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  5⤵
                    PID:1584
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      6⤵
                      • Launches sc.exe
                      PID:1468
          • C:\Windows\windefender.exe
            C:\Windows\windefender.exe
            1⤵
              PID:580

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzpaacqd.haq.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                    Filesize

                    2KB

                    MD5

                    d0c46cad6c0778401e21910bd6b56b70

                    SHA1

                    7be418951ea96326aca445b8dfe449b2bfa0dca6

                    SHA256

                    9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                    SHA512

                    057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    879003b653867b47f5db781cd012a43f

                    SHA1

                    960034fc3f32d7b0fbbd988a1b763617b48a7bbd

                    SHA256

                    ae1a9e66888a4a4489bfcbe6b697f6855f00eb173179d2164967d1f20d25fc7b

                    SHA512

                    a6b1ca9be204f4ecb07af111c27f2a675fe9952b7bc3754600e46daaf32b42182e16cb3aca44640f1725480b7e4248288697025ba827293bbfa94b2df2694830

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    543272e7939ea8760cc6628469b78507

                    SHA1

                    d9069761c155961c93f2970a2c580224e71aa6e2

                    SHA256

                    8ec19110876aa079511eaacf4b25fdec03a5e314083b421510ad2a3deb488850

                    SHA512

                    9d9c7294f912460ffff861278b4adae94afa9a96f2330aa26a18179ee7e6b259795e9618bb28bb1d4c54af570c82da595973fa3864962733722e7fd7ccb1a404

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    c54360caa97b58f54e58ba7d727bb1a5

                    SHA1

                    1c09e568eb8cbb4d84ff7f6210e8b2745d22818b

                    SHA256

                    e367042c53fbeb138dd76b88059fad30d642e473a8aa87a1401179709836d580

                    SHA512

                    c89794f5d2974bcd408235aaee8dd501676baeeace690ca86b194b10ada2cbbf65e62a10313379de7bbc3c4e6adc49963275ce14782e1ba3f9e64e14a6b14861

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    4e94404ae6eaa8ec72037e29f22bca9d

                    SHA1

                    d996958431d92d3b951ee2225d5929adb4900fd5

                    SHA256

                    6b2f88da05ba68b0dc3f18f5b383326670bbce4676fdb03094f89fe3f6ffed39

                    SHA512

                    57f6f11b819787b2604ace64721080adec2ee76e5d3d2d9d52c20e19cbc7b1fd598df89196b30f9bf22827fe478008e36923d584fb42a01aea84b5566ceae58c

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    80582dd4b210b940bd22b9e66c6096bf

                    SHA1

                    1699d0ff4bfc0d92dcc047101ea42e8821b4dd46

                    SHA256

                    9ce9d65c54bb675142900495c840bae2a5e687b69e5db1b841d47b75ad3b1976

                    SHA512

                    43e0c63378ffed9dd5ac0da90e16a84507ef567ab6df5fd8159458602ef3685214106dc2a66d41ad6bbe0b999c9924ad17779d712895c0f88821fcae332c584f

                  • C:\Windows\rss\csrss.exe

                    Filesize

                    4.2MB

                    MD5

                    62dc86ed5cec63e5ccb959c407a4a591

                    SHA1

                    2070a84ba529d62ee28745bbc5c810bfbb9b721c

                    SHA256

                    71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1

                    SHA512

                    de79eeef9db2c8ffc50fc843a397f3bd48d61a52287ecc13ab32093a4405bf3c338cb87f4bf71f76c1e7e6e30dca6a4cc683657009558ff6b7ac11295884dc3c

                  • memory/580-293-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/580-261-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/768-82-0x0000000007810000-0x0000000007821000-memory.dmp

                    Filesize

                    68KB

                  • memory/768-69-0x0000000070810000-0x0000000070B67000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/768-65-0x0000000002B20000-0x0000000002B30000-memory.dmp

                    Filesize

                    64KB

                  • memory/768-67-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/768-66-0x0000000002B20000-0x0000000002B30000-memory.dmp

                    Filesize

                    64KB

                  • memory/768-68-0x00000000705E0000-0x000000007062C000-memory.dmp

                    Filesize

                    304KB

                  • memory/768-78-0x00000000074C0000-0x0000000007564000-memory.dmp

                    Filesize

                    656KB

                  • memory/768-81-0x0000000002B20000-0x0000000002B30000-memory.dmp

                    Filesize

                    64KB

                  • memory/768-80-0x000000007F0D0000-0x000000007F0E0000-memory.dmp

                    Filesize

                    64KB

                  • memory/768-59-0x0000000005DF0000-0x0000000006147000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/768-83-0x0000000007860000-0x0000000007875000-memory.dmp

                    Filesize

                    84KB

                  • memory/768-86-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1404-3-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/1404-64-0x0000000004F60000-0x0000000005360000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/1404-2-0x0000000005360000-0x0000000005C4B000-memory.dmp

                    Filesize

                    8.9MB

                  • memory/1404-79-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/1404-1-0x0000000004F60000-0x0000000005360000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/1468-100-0x00000000705E0000-0x000000007062C000-memory.dmp

                    Filesize

                    304KB

                  • memory/1468-88-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1468-90-0x0000000000D20000-0x0000000000D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1468-112-0x0000000000D20000-0x0000000000D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1468-111-0x0000000000D20000-0x0000000000D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1468-101-0x0000000070760000-0x0000000070AB7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1468-114-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1468-89-0x0000000000D20000-0x0000000000D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1724-129-0x00000000705E0000-0x000000007062C000-memory.dmp

                    Filesize

                    304KB

                  • memory/1724-116-0x0000000002A80000-0x0000000002A90000-memory.dmp

                    Filesize

                    64KB

                  • memory/1724-130-0x0000000070830000-0x0000000070B87000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1724-120-0x00000000059F0000-0x0000000005D47000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1724-115-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1724-117-0x0000000002A80000-0x0000000002A90000-memory.dmp

                    Filesize

                    64KB

                  • memory/1904-244-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/2224-37-0x0000000007D60000-0x0000000007E04000-memory.dmp

                    Filesize

                    656KB

                  • memory/2224-11-0x0000000006240000-0x00000000062A6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2224-43-0x0000000007EF0000-0x0000000007F01000-memory.dmp

                    Filesize

                    68KB

                  • memory/2224-42-0x0000000007FE0000-0x0000000008076000-memory.dmp

                    Filesize

                    600KB

                  • memory/2224-41-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

                    Filesize

                    40KB

                  • memory/2224-39-0x00000000084D0000-0x0000000008B4A000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2224-40-0x0000000007E90000-0x0000000007EAA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2224-4-0x00000000053D0000-0x0000000005406000-memory.dmp

                    Filesize

                    216KB

                  • memory/2224-38-0x0000000003060000-0x0000000003070000-memory.dmp

                    Filesize

                    64KB

                  • memory/2224-24-0x000000007F7A0000-0x000000007F7B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2224-36-0x0000000007D40000-0x0000000007D5E000-memory.dmp

                    Filesize

                    120KB

                  • memory/2224-26-0x00000000705E0000-0x000000007062C000-memory.dmp

                    Filesize

                    304KB

                  • memory/2224-27-0x0000000070760000-0x0000000070AB7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2224-25-0x0000000007D00000-0x0000000007D34000-memory.dmp

                    Filesize

                    208KB

                  • memory/2224-5-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2224-23-0x0000000006DB0000-0x0000000006DF6000-memory.dmp

                    Filesize

                    280KB

                  • memory/2224-22-0x00000000068A0000-0x00000000068EC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2224-21-0x0000000006860000-0x000000000687E000-memory.dmp

                    Filesize

                    120KB

                  • memory/2224-20-0x0000000006330000-0x0000000006687000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2224-45-0x0000000007F50000-0x0000000007F65000-memory.dmp

                    Filesize

                    84KB

                  • memory/2224-46-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2224-47-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

                    Filesize

                    32KB

                  • memory/2224-50-0x0000000074370000-0x0000000074B21000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2224-44-0x0000000007F40000-0x0000000007F4E000-memory.dmp

                    Filesize

                    56KB

                  • memory/2224-10-0x0000000006160000-0x00000000061C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2224-8-0x0000000003060000-0x0000000003070000-memory.dmp

                    Filesize

                    64KB

                  • memory/2224-9-0x00000000060C0000-0x00000000060E2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2224-7-0x0000000005A40000-0x000000000606A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/2224-6-0x0000000003060000-0x0000000003070000-memory.dmp

                    Filesize

                    64KB

                  • memory/3396-53-0x0000000005230000-0x0000000005B1B000-memory.dmp

                    Filesize

                    8.9MB

                  • memory/3396-52-0x0000000004E30000-0x000000000522F000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/3396-63-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/3396-110-0x0000000004E30000-0x000000000522F000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/3396-203-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-254-0x0000000074B60000-0x0000000074BA1000-memory.dmp

                    Filesize

                    260KB

                  • memory/4800-229-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-249-0x0000000074BF0000-0x0000000074C57000-memory.dmp

                    Filesize

                    412KB

                  • memory/4800-231-0x0000000074BF0000-0x0000000074C57000-memory.dmp

                    Filesize

                    412KB

                  • memory/4800-247-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-233-0x0000000074BD0000-0x0000000074BEE000-memory.dmp

                    Filesize

                    120KB

                  • memory/4800-263-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-279-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-234-0x0000000074BB0000-0x0000000074BC1000-memory.dmp

                    Filesize

                    68KB

                  • memory/4800-295-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-311-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-327-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB

                  • memory/4800-343-0x0000000000400000-0x0000000003118000-memory.dmp

                    Filesize

                    45.1MB