Analysis
-
max time kernel
1s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 15:36
Static task
static1
Behavioral task
behavioral1
Sample
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe
Resource
win10v2004-20240412-en
General
-
Target
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe
-
Size
4.2MB
-
MD5
93649fab2bbe2b82d4f45f5191535647
-
SHA1
850d74d61c16ca5b5782ba8ddf4307517fc9b05f
-
SHA256
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f
-
SHA512
5a041ca65acbd3c233b367d8945383f9dcd4c77a7aa508b74c422db9c9984bb2718bcb6c7e70f453a657f841481fdf81e2ed3e561423b76cffd44eddc279db4f
-
SSDEEP
98304:1+Gg6aXQ+/QyN9wV3/YhHbVpnwBVKjBiw+3St8KCbj:WXQwQ89A3/Y5DnwBWu3Q8K4
Malware Config
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/8-2-0x0000000006500000-0x0000000006DEB000-memory.dmp family_glupteba behavioral1/memory/1080-57-0x00000000064B0000-0x0000000006D9B000-memory.dmp family_glupteba behavioral1/memory/8-104-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/1080-152-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-252-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-254-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-256-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-266-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-269-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-272-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-275-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-278-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-281-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-284-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-287-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/2328-290-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4068 netsh.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/624-263-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3056-267-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3056-273-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3056-282-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2812 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4452 schtasks.exe 2728 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5loi2xp.pco.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5373a5114accc6c0733ec3abd498779cc
SHA12dfa74bc29147fe8ce279ef222bb7c3e0d67e231
SHA256b7e0eb4d4b637d5e55d746131b46a68887fe8dc0d5725a48c653bb1478d20521
SHA5128c2b994d514f2224a117c75d40d67a846afa3199cb534dadad7ee9f88c2b61aa2f7fd0d45ea9b28398310230eb416bb34dd602fcc107a965d465ecc8db53f306
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5064a75cdbe7b20270d62d90ad92e44b7
SHA19bf9a6f78704462a57ad63072a35d4bdf7ad8433
SHA256d5535e1bd35158271dd2bccae5732d484a2478fce2e88a4ff6ea990fa226d357
SHA5121110b1c8a86b76e61472aa20314b6eece5d22b47cf73a27600dbcaceafc1f86d3e8040a8e045242a6c8c297c52dfe0a12478c9606357e10862eb769b1938633c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5450b181525ddb5f1fd65941ac9931ed6
SHA106ac162aab8cc4f9a30f2aa5d7c345f01c57c2f8
SHA256b9754cf4035e78be52d12f8680939caab33ef55ac5d5bd4ecb8835dc41a98b7c
SHA5125813af633e5a3a134c4ab9e1131bab8d55dbda937372b11efc888a99981d90d46f574a59726a601b9205ad199b97fff8774f81c5e00c977d667f0db9c97c442e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD531ec7b1512582d23603de49367615238
SHA13cbedae74ab035d75d353d7ef00ca0ad201f47d7
SHA256887a8d0d97ee4e9b6f0d7278952a5e5f06af339ae07580d24b5d9001f521e3bb
SHA51206ad955aa7241dff90ce2b3207fc8f80ea1301cc3813ba87ff3bc7df09a721521f257f1b3524f79bb0eff80442ab6fc2c9d340a2355d3a293cbc5025c7a565cc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e5e249c2af0bfeda66533f59e5f413ad
SHA186bb848930b2753f91f532b6d8f47de2b664305e
SHA256f208b152cd4c5de1db57ad7890d85b9760cfe9e89c86852204dab8b5a7f83fcc
SHA512bfbd1c6dff992f3c9c7abc65d0f4aa3783c3082a076b211e671cb0a9adc215fbeb7932822a742560df07f99e57e233f36d2468e7ea70f5f518d710a56760324e
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD593649fab2bbe2b82d4f45f5191535647
SHA1850d74d61c16ca5b5782ba8ddf4307517fc9b05f
SHA2565e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f
SHA5125a041ca65acbd3c233b367d8945383f9dcd4c77a7aa508b74c422db9c9984bb2718bcb6c7e70f453a657f841481fdf81e2ed3e561423b76cffd44eddc279db4f
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/8-56-0x0000000004950000-0x0000000004D57000-memory.dmpFilesize
4.0MB
-
memory/8-1-0x0000000004950000-0x0000000004D57000-memory.dmpFilesize
4.0MB
-
memory/8-104-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/8-2-0x0000000006500000-0x0000000006DEB000-memory.dmpFilesize
8.9MB
-
memory/624-263-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1080-152-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/1080-116-0x0000000004A90000-0x0000000004E91000-memory.dmpFilesize
4.0MB
-
memory/1080-57-0x00000000064B0000-0x0000000006D9B000-memory.dmpFilesize
8.9MB
-
memory/1080-55-0x0000000004A90000-0x0000000004E91000-memory.dmpFilesize
4.0MB
-
memory/1596-85-0x0000000007410000-0x0000000007421000-memory.dmpFilesize
68KB
-
memory/1596-58-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/1596-89-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/1596-86-0x0000000007460000-0x0000000007474000-memory.dmpFilesize
80KB
-
memory/1596-83-0x00000000070E0000-0x0000000007183000-memory.dmpFilesize
652KB
-
memory/1596-84-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1596-72-0x0000000070C10000-0x0000000070C5C000-memory.dmpFilesize
304KB
-
memory/1596-73-0x0000000070D90000-0x00000000710E4000-memory.dmpFilesize
3.3MB
-
memory/1596-71-0x000000007F1A0000-0x000000007F1B0000-memory.dmpFilesize
64KB
-
memory/1596-70-0x0000000005A80000-0x0000000005DD4000-memory.dmpFilesize
3.3MB
-
memory/1596-60-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1596-59-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2328-275-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-281-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-266-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-256-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-254-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-252-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-269-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-272-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-293-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-290-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-278-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-287-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2328-284-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3008-134-0x000000007F570000-0x000000007F580000-memory.dmpFilesize
64KB
-
memory/3008-122-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/3008-146-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/3008-135-0x0000000070C10000-0x0000000070C5C000-memory.dmpFilesize
304KB
-
memory/3008-136-0x0000000070D90000-0x00000000710E4000-memory.dmpFilesize
3.3MB
-
memory/3008-123-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/3056-282-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3056-267-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3056-273-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3892-119-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3892-92-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3892-106-0x0000000070D90000-0x00000000710E4000-memory.dmpFilesize
3.3MB
-
memory/3892-105-0x0000000070C10000-0x0000000070C5C000-memory.dmpFilesize
304KB
-
memory/3892-91-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/3892-118-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3892-117-0x000000007EF50000-0x000000007EF60000-memory.dmpFilesize
64KB
-
memory/3892-93-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3892-121-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/4876-7-0x00000000053A0000-0x00000000059C8000-memory.dmpFilesize
6.2MB
-
memory/4876-40-0x00000000077A0000-0x00000000077BE000-memory.dmpFilesize
120KB
-
memory/4876-20-0x0000000005BA0000-0x0000000005EF4000-memory.dmpFilesize
3.3MB
-
memory/4876-21-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/4876-42-0x00000000077C0000-0x0000000007863000-memory.dmpFilesize
652KB
-
memory/4876-24-0x0000000007530000-0x00000000075A6000-memory.dmpFilesize
472KB
-
memory/4876-26-0x00000000075B0000-0x00000000075CA000-memory.dmpFilesize
104KB
-
memory/4876-9-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB
-
memory/4876-10-0x0000000005AB0000-0x0000000005B16000-memory.dmpFilesize
408KB
-
memory/4876-8-0x0000000005300000-0x0000000005322000-memory.dmpFilesize
136KB
-
memory/4876-22-0x0000000006290000-0x00000000062DC000-memory.dmpFilesize
304KB
-
memory/4876-6-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/4876-5-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/4876-25-0x0000000007C30000-0x00000000082AA000-memory.dmpFilesize
6.5MB
-
memory/4876-28-0x0000000007760000-0x0000000007792000-memory.dmpFilesize
200KB
-
memory/4876-23-0x0000000006700000-0x0000000006744000-memory.dmpFilesize
272KB
-
memory/4876-4-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/4876-3-0x0000000002C00000-0x0000000002C36000-memory.dmpFilesize
216KB
-
memory/4876-53-0x0000000074D70000-0x0000000075520000-memory.dmpFilesize
7.7MB
-
memory/4876-49-0x0000000007A10000-0x0000000007A2A000-memory.dmpFilesize
104KB
-
memory/4876-50-0x0000000007960000-0x0000000007968000-memory.dmpFilesize
32KB
-
memory/4876-48-0x0000000007920000-0x0000000007934000-memory.dmpFilesize
80KB
-
memory/4876-47-0x0000000007910000-0x000000000791E000-memory.dmpFilesize
56KB
-
memory/4876-46-0x00000000078D0000-0x00000000078E1000-memory.dmpFilesize
68KB
-
memory/4876-45-0x0000000007970000-0x0000000007A06000-memory.dmpFilesize
600KB
-
memory/4876-44-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/4876-27-0x000000007F7C0000-0x000000007F7D0000-memory.dmpFilesize
64KB
-
memory/4876-29-0x0000000070C10000-0x0000000070C5C000-memory.dmpFilesize
304KB
-
memory/4876-30-0x0000000070DB0000-0x0000000071104000-memory.dmpFilesize
3.3MB
-
memory/4876-41-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/4876-43-0x00000000078B0000-0x00000000078BA000-memory.dmpFilesize
40KB