Analysis

  • max time kernel
    169s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 18:06

General

  • Target

    43e0ae00986b7167745b2d10cbd141a57d7515ca892867297948315c8b741415.exe

  • Size

    4.2MB

  • MD5

    bd655444fb4bc2ab9b793b2d331ca005

  • SHA1

    164160f766c7a7652e49ae5aadad29d0526135be

  • SHA256

    43e0ae00986b7167745b2d10cbd141a57d7515ca892867297948315c8b741415

  • SHA512

    d71eae8de8b5d636abb22ab0837da9d2777e2d0888e4ecadd669e79cb98730b36ef3b8296cc4fcb794a604b674862a811507a11408bb250c1cee927c348daafd

  • SSDEEP

    98304:NBy5JAu+Hk0Et5Mgg8VWlfA2+5+VVv7Fm6fCY:GAu+ENnjVyYiVNw4d

Score
10/10

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43e0ae00986b7167745b2d10cbd141a57d7515ca892867297948315c8b741415.exe
    "C:\Users\Admin\AppData\Local\Temp\43e0ae00986b7167745b2d10cbd141a57d7515ca892867297948315c8b741415.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3336
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2268

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l2baamqp.taf.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/1348-7-0x00000000040E0000-0x00000000049CB000-memory.dmp

            Filesize

            8.9MB

          • memory/1348-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1348-4-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1348-5-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1348-6-0x0000000003CD0000-0x00000000040D1000-memory.dmp

            Filesize

            4.0MB

          • memory/1348-1-0x0000000003CD0000-0x00000000040D1000-memory.dmp

            Filesize

            4.0MB

          • memory/1348-45-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1348-2-0x00000000040E0000-0x00000000049CB000-memory.dmp

            Filesize

            8.9MB

          • memory/3336-41-0x0000000006710000-0x0000000006754000-memory.dmp

            Filesize

            272KB

          • memory/3336-11-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

          • memory/3336-15-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

          • memory/3336-16-0x00000000052C0000-0x00000000058E8000-memory.dmp

            Filesize

            6.2MB

          • memory/3336-12-0x0000000004B90000-0x0000000004BC6000-memory.dmp

            Filesize

            216KB

          • memory/3336-22-0x0000000005090000-0x00000000050B2000-memory.dmp

            Filesize

            136KB

          • memory/3336-18-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

          • memory/3336-24-0x00000000051B0000-0x0000000005216000-memory.dmp

            Filesize

            408KB

          • memory/3336-25-0x00000000058F0000-0x0000000005956000-memory.dmp

            Filesize

            408KB

          • memory/3336-14-0x0000000074920000-0x00000000750D0000-memory.dmp

            Filesize

            7.7MB

          • memory/3336-36-0x0000000005B60000-0x0000000005EB4000-memory.dmp

            Filesize

            3.3MB

          • memory/3336-38-0x00000000060F0000-0x000000000610E000-memory.dmp

            Filesize

            120KB

          • memory/3336-39-0x00000000061E0000-0x000000000622C000-memory.dmp

            Filesize

            304KB

          • memory/3336-20-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

          • memory/3336-43-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

          • memory/3336-44-0x0000000007490000-0x0000000007506000-memory.dmp

            Filesize

            472KB

          • memory/3336-8-0x0000000074920000-0x00000000750D0000-memory.dmp

            Filesize

            7.7MB