Analysis
-
max time kernel
1s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-04-2024 15:36
Static task
static1
Behavioral task
behavioral1
Sample
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe
Resource
win10v2004-20240412-en
General
-
Target
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe
-
Size
4.2MB
-
MD5
93649fab2bbe2b82d4f45f5191535647
-
SHA1
850d74d61c16ca5b5782ba8ddf4307517fc9b05f
-
SHA256
5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f
-
SHA512
5a041ca65acbd3c233b367d8945383f9dcd4c77a7aa508b74c422db9c9984bb2718bcb6c7e70f453a657f841481fdf81e2ed3e561423b76cffd44eddc279db4f
-
SSDEEP
98304:1+Gg6aXQ+/QyN9wV3/YhHbVpnwBVKjBiw+3St8KCbj:WXQwQ89A3/Y5DnwBWu3Q8K4
Malware Config
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/4092-2-0x00000000066C0000-0x0000000006FAB000-memory.dmp family_glupteba behavioral2/memory/4092-64-0x00000000066C0000-0x0000000006FAB000-memory.dmp family_glupteba behavioral2/memory/4092-83-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/2300-156-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-236-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-239-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-242-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-253-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-256-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-261-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-265-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-269-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-273-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-276-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-280-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4384-285-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1156 netsh.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/2792-249-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4388-254-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4388-262-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2324 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1020 schtasks.exe 2528 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"C:\Users\Admin\AppData\Local\Temp\5e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tcodelk.hjz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52b4b2f06904c9ec7ec2a06c0e2eb6963
SHA1345070ebba5fa553e67a1b67d090a2a8e6023332
SHA2564b8c243bca8e33b4ec85100c7559ba92e7ad7642ac7d424b9867c31b4acf0d17
SHA512c60e7202d6be8878f9203ebf77b058e228e90ea49e03f28d1732f05c469ed9a90e2a7fbbc62aa4b02a04e2540bad35f0ec1bb20c93f94805a0d374f4e5d0f353
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53ddb41bf8bf566a8b597895ebc80553f
SHA1596aa89482469cdff9ec071c5f432c18745fb116
SHA2568f25a3ac758db4b36d923cd783ed56cec1628c62331535e69b859006199488bd
SHA512a9f22e08a2989a6ef71005e962f6f0a5712f59d407c7abae53e7f9f184adedf0714a0f7b416a1b5d6d65e5afd3ce5c0ca2afabad76d91f6e37f13bf6a6e457f3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e08b3f5f5fbcf341dc81c26823db839d
SHA19dd737381ccc35de78b6d244b35e89dab291e296
SHA256d41448f0e7e3ea69cf6665b3021977c8f853651fa4d93ce0f4752ba7831a89e8
SHA512cac0d69a2bb612be3a34db4c07b103e35530055da559b909e00afb64f506d15553a08bd4927d9ce6fb9de3c9b7ae7b9339ce77d1bae31a96d610d92e64368c4c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5faef37d5be2ba64899acc85f3ea811fe
SHA16d18ba9fff7213c296eac65a35b75b5f59845cbb
SHA25665058d48c2b33bba6ed94a76e1e113eda7d5fa39dc23da269715da6f8ac19821
SHA51248d1e43b8cd5f17dc16c1a86fe69098b91fef69da48e04260224cc7123f0792b058bf4b14888debd55e9f63d67600c832298c69db0b9426f6fbbe2f8fdd09d03
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f9d210f80c664122126cdd47afcd1a5a
SHA12b38c4a914fa1853760c2706ea8871fc6797167b
SHA2566d5c3b8fd623f9cf5010d7d7d39383812b52a9b9468e71f1a4ab9bad7d4a40de
SHA512a9b9bb246356456f8fa0e5212049bc7c175ef2c8f48efaf65840aa6cccee39b5e85a682cda76305eeb1b8d173ac55ec14715214d2a6ae2d2fd71cc70b50f9540
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD593649fab2bbe2b82d4f45f5191535647
SHA1850d74d61c16ca5b5782ba8ddf4307517fc9b05f
SHA2565e12f91557ee26f66eba341c5300ea2ac102831b36638951a0204d55a0ee217f
SHA5125a041ca65acbd3c233b367d8945383f9dcd4c77a7aa508b74c422db9c9984bb2718bcb6c7e70f453a657f841481fdf81e2ed3e561423b76cffd44eddc279db4f
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/944-78-0x0000000007350000-0x0000000007365000-memory.dmpFilesize
84KB
-
memory/944-53-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/944-54-0x0000000005870000-0x0000000005BC7000-memory.dmpFilesize
3.3MB
-
memory/944-55-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/944-52-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/944-66-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/944-65-0x000000007FB80000-0x000000007FB90000-memory.dmpFilesize
64KB
-
memory/944-67-0x0000000070DA0000-0x00000000710F7000-memory.dmpFilesize
3.3MB
-
memory/944-76-0x0000000006FC0000-0x0000000007064000-memory.dmpFilesize
656KB
-
memory/944-77-0x0000000007300000-0x0000000007311000-memory.dmpFilesize
68KB
-
memory/944-81-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/1460-113-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/1460-138-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/1460-124-0x000000007FA50000-0x000000007FA60000-memory.dmpFilesize
64KB
-
memory/1460-112-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/1460-114-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/1460-136-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/1460-126-0x0000000070CD0000-0x0000000071027000-memory.dmpFilesize
3.3MB
-
memory/1460-125-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/1460-135-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/2144-92-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/2144-99-0x0000000070CD0000-0x0000000071027000-memory.dmpFilesize
3.3MB
-
memory/2144-94-0x00000000033A0000-0x00000000033B0000-memory.dmpFilesize
64KB
-
memory/2144-95-0x00000000063A0000-0x00000000066F7000-memory.dmpFilesize
3.3MB
-
memory/2144-93-0x00000000033A0000-0x00000000033B0000-memory.dmpFilesize
64KB
-
memory/2144-109-0x00000000033A0000-0x00000000033B0000-memory.dmpFilesize
64KB
-
memory/2144-98-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/2144-97-0x000000007FA50000-0x000000007FA60000-memory.dmpFilesize
64KB
-
memory/2144-111-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/2300-50-0x00000000049F0000-0x0000000004DF3000-memory.dmpFilesize
4.0MB
-
memory/2300-156-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2300-108-0x00000000049F0000-0x0000000004DF3000-memory.dmpFilesize
4.0MB
-
memory/2792-249-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4092-64-0x00000000066C0000-0x0000000006FAB000-memory.dmpFilesize
8.9MB
-
memory/4092-2-0x00000000066C0000-0x0000000006FAB000-memory.dmpFilesize
8.9MB
-
memory/4092-51-0x0000000004B20000-0x0000000004F20000-memory.dmpFilesize
4.0MB
-
memory/4092-83-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4092-1-0x0000000004B20000-0x0000000004F20000-memory.dmpFilesize
4.0MB
-
memory/4196-34-0x0000000007200000-0x000000000721E000-memory.dmpFilesize
120KB
-
memory/4196-48-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/4196-37-0x0000000007990000-0x000000000800A000-memory.dmpFilesize
6.5MB
-
memory/4196-24-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/4196-39-0x0000000007380000-0x000000000738A000-memory.dmpFilesize
40KB
-
memory/4196-23-0x00000000071C0000-0x00000000071F4000-memory.dmpFilesize
208KB
-
memory/4196-22-0x000000007F930000-0x000000007F940000-memory.dmpFilesize
64KB
-
memory/4196-40-0x0000000007490000-0x0000000007526000-memory.dmpFilesize
600KB
-
memory/4196-41-0x00000000073A0000-0x00000000073B1000-memory.dmpFilesize
68KB
-
memory/4196-42-0x00000000073F0000-0x00000000073FE000-memory.dmpFilesize
56KB
-
memory/4196-25-0x0000000070CE0000-0x0000000071037000-memory.dmpFilesize
3.3MB
-
memory/4196-35-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/4196-36-0x0000000007220000-0x00000000072C4000-memory.dmpFilesize
656KB
-
memory/4196-43-0x0000000007400000-0x0000000007415000-memory.dmpFilesize
84KB
-
memory/4196-21-0x0000000006350000-0x0000000006396000-memory.dmpFilesize
280KB
-
memory/4196-20-0x0000000005DD0000-0x0000000005E1C000-memory.dmpFilesize
304KB
-
memory/4196-19-0x0000000005D90000-0x0000000005DAE000-memory.dmpFilesize
120KB
-
memory/4196-18-0x0000000005870000-0x0000000005BC7000-memory.dmpFilesize
3.3MB
-
memory/4196-9-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/4196-8-0x0000000004F70000-0x0000000004FD6000-memory.dmpFilesize
408KB
-
memory/4196-7-0x0000000004DD0000-0x0000000004DF2000-memory.dmpFilesize
136KB
-
memory/4196-38-0x0000000007340000-0x000000000735A000-memory.dmpFilesize
104KB
-
memory/4196-6-0x0000000004FE0000-0x000000000560A000-memory.dmpFilesize
6.2MB
-
memory/4196-44-0x0000000007450000-0x000000000746A000-memory.dmpFilesize
104KB
-
memory/4196-5-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/4196-4-0x00000000748E0000-0x0000000075091000-memory.dmpFilesize
7.7MB
-
memory/4196-3-0x00000000028C0000-0x00000000028F6000-memory.dmpFilesize
216KB
-
memory/4196-45-0x0000000007470000-0x0000000007478000-memory.dmpFilesize
32KB
-
memory/4384-276-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-269-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-236-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-144-0x0000000005000000-0x0000000005400000-memory.dmpFilesize
4.0MB
-
memory/4384-289-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-285-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-242-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-256-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-253-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-265-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-261-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-273-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-239-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4384-280-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4388-254-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4388-262-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB