Analysis
- max time kernel
6s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
19/04/2024, 10:07
General
- Target fe296b9d3e97a7b27522752d9408e2dfe3d62842eb4faf9a120622c4583ba202.exe
- Size 4.2MB
- Sample240419-l56graff7v
- SHA256 fe296b9d3e97a7b27522752d9408e2dfe3d62842eb4faf9a120622c4583ba202
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe296b9d3e97a7b27522752d9408e2dfe3d62842eb4faf9a120622c4583ba202.exe"C:\Users\Admin\AppData\Local\Temp\fe296b9d3e97a7b27522752d9408e2dfe3d62842eb4faf9a120622c4583ba202.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wg0quwd1.svu.ps1
memory/2280-25-0x0000000006F40000-0x0000000006F74000-memory.dmp
memory/2280-26-0x0000000070530000-0x000000007057C000-memory.dmp
memory/2280-4-0x0000000002690000-0x00000000026C6000-memory.dmp
memory/2280-5-0x00000000742C0000-0x0000000074A71000-memory.dmp
memory/2280-6-0x0000000002610000-0x0000000002620000-memory.dmp
memory/2280-7-0x0000000004E50000-0x000000000547A000-memory.dmp
memory/2280-8-0x0000000002610000-0x0000000002620000-memory.dmp
memory/2280-9-0x0000000004C60000-0x0000000004C82000-memory.dmp
memory/2280-11-0x0000000004DE0000-0x0000000004E46000-memory.dmp
memory/2280-10-0x0000000004D00000-0x0000000004D66000-memory.dmp
memory/2280-49-0x00000000742C0000-0x0000000074A71000-memory.dmp
memory/2280-20-0x0000000005730000-0x0000000005A87000-memory.dmp
memory/2280-21-0x0000000005B20000-0x0000000005B3E000-memory.dmp
memory/2280-22-0x0000000005B50000-0x0000000005B9C000-memory.dmp
memory/2280-46-0x00000000071F0000-0x00000000071F8000-memory.dmp
memory/2280-23-0x00000000060B0000-0x00000000060F6000-memory.dmp
memory/2280-27-0x00000000706B0000-0x0000000070A07000-memory.dmp
memory/2280-24-0x000000007F440000-0x000000007F450000-memory.dmp
memory/2280-45-0x00000000071D0000-0x00000000071EA000-memory.dmp
memory/2280-36-0x0000000006F80000-0x0000000006F9E000-memory.dmp
memory/2280-37-0x0000000006FA0000-0x0000000007044000-memory.dmp
memory/2280-38-0x0000000007710000-0x0000000007D8A000-memory.dmp
memory/2280-39-0x00000000070C0000-0x00000000070DA000-memory.dmp
memory/2280-40-0x0000000007100000-0x000000000710A000-memory.dmp
memory/2280-41-0x0000000007210000-0x00000000072A6000-memory.dmp
memory/2280-42-0x0000000007130000-0x0000000007141000-memory.dmp
memory/2280-43-0x0000000007170000-0x000000000717E000-memory.dmp
memory/2280-44-0x0000000007180000-0x0000000007195000-memory.dmp
memory/5016-1-0x0000000004F70000-0x000000000536F000-memory.dmp
memory/5016-3-0x0000000000400000-0x000000000310F000-memory.dmp
memory/5016-2-0x0000000005370000-0x0000000005C5B000-memory.dmp