Analysis
-
max time kernel
1s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe
Resource
win10v2004-20240412-en
General
-
Target
8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe
-
Size
4.2MB
-
MD5
3639974c2ae4bf36a2f066ef29b435a2
-
SHA1
335e5459ec83bd45ea9b77e6ab8d367e16e27866
-
SHA256
8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4
-
SHA512
7d0c9c1d9c9afec7ebb07e8aac7a4c0b2382cf39c81ee562c38eb73745541a38a8c121eca062a1e0ea96c0da95bd83e73e26c7e65a5219c8f451540be3536806
-
SSDEEP
98304:9+Gg6aXQ+/QyN9wV3/YhHbVpnwBVKjBiw+3St8KeR:OXQwQ89A3/Y5DnwBWu3Q8KC
Malware Config
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/3864-2-0x0000000006670000-0x0000000006F5B000-memory.dmp family_glupteba behavioral1/memory/1232-56-0x00000000065D0000-0x0000000006EBB000-memory.dmp family_glupteba behavioral1/memory/3864-53-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3864-57-0x0000000006670000-0x0000000006F5B000-memory.dmp family_glupteba behavioral1/memory/1232-156-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-257-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-259-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-261-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-271-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-274-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-277-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-280-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-283-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-286-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-289-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3876-292-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2916 netsh.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4392-268-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/224-272-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/224-278-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2476 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4036 schtasks.exe 2480 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe"C:\Users\Admin\AppData\Local\Temp\8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe"C:\Users\Admin\AppData\Local\Temp\8f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oafdeizv.11v.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5321f5b023ff1b4f8af16355c5ce0be59
SHA15de078a8da6dd8a6f32759d6f05377880d8c1d57
SHA256cb8c94b620570c1165056bce1036faea6bbf573be95be900aa0c64d53fd99e6c
SHA512e69cd57cbe52427a25b501059bdf0887a5151acdd3936b050fc9baa878a58b7b6b756a0733701cb9f2334157371cb419ca20ed356cf1b2010276479ebfc1ee56
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5cb36c0c0e1b2877758f7cd23a3891c6d
SHA1d2b85e089b67d3ee7dcbefc82720acc56380d24e
SHA256b7019c32135a02a6a4e2069c92e613c0afef1853b4fa0f01c94f32dda45804fe
SHA5128dbe7fb56783f600f220f9bdeef7319bfc416c9e90a75a2b480f94ee3b8fae3978e9812de28d2a2b9bba3ec511a334df786104213ecac4a289fabeba6f7852bf
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD516cffbcee858534d16ad5589abc40edd
SHA1112d4db25264ec04b05b61b362ede882b69553a4
SHA256fc01359481a234114937230c82337fdb9f685714d188108b19d3092ff11bb8e5
SHA5122e003310666c0d83077d89f206da3f0d48d4f9da2d3cddae33c9ba4d3d4f8a4648022d3c460bcc5b97dc1815f95fff1ff64624572e58b5f3a13398ef0e19f0bc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD535eb0e4799224d3c70fded74ce5a379c
SHA11caf673a593c6238fe98f4c835683b1f43b0d4bb
SHA25696b34df2d4edb1daadd346e34409a72d23ae322c77201244c21cab9d09ce0691
SHA5129e05876481a75f0b9382da6280bf74b7f7763b575131131cca796215785ba5c176c8c0d7f952c88f6f886e9f1ba4c70f91ddb315fba4b501dafeafc4092cfd57
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD515c8644af20dfab869311b8463ba5ca5
SHA1fdfe1851b4ce799c34bf1e320ba8dc782a5b101a
SHA2564b55094e0bc60487c546b7bde95b0209374f24f1af0894ff1c6791aba71d4717
SHA5125d5d977dbfcf1c4457fd4664737072b574dea779c576ec00d82a4fe1299e9f0a1f04e1b9ac48bd7361788ba8f0adee97d1dbc9da54309994bf7d98f96efc8f10
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD53639974c2ae4bf36a2f066ef29b435a2
SHA1335e5459ec83bd45ea9b77e6ab8d367e16e27866
SHA2568f7b0c00b10d8d69656e5b3eb6e7f87386c45be7cb55428d72801de5e1cdc5c4
SHA5127d0c9c1d9c9afec7ebb07e8aac7a4c0b2382cf39c81ee562c38eb73745541a38a8c121eca062a1e0ea96c0da95bd83e73e26c7e65a5219c8f451540be3536806
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/224-272-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/224-278-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1232-156-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/1232-135-0x0000000004930000-0x0000000004D2C000-memory.dmpFilesize
4.0MB
-
memory/1232-55-0x0000000004930000-0x0000000004D2C000-memory.dmpFilesize
4.0MB
-
memory/1232-56-0x00000000065D0000-0x0000000006EBB000-memory.dmpFilesize
8.9MB
-
memory/2312-109-0x00000000711B0000-0x0000000071504000-memory.dmpFilesize
3.3MB
-
memory/2312-107-0x000000007FCA0000-0x000000007FCB0000-memory.dmpFilesize
64KB
-
memory/2312-108-0x0000000070A10000-0x0000000070A5C000-memory.dmpFilesize
304KB
-
memory/2312-105-0x0000000005590000-0x00000000058E4000-memory.dmpFilesize
3.3MB
-
memory/2312-95-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/2312-94-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/2312-93-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/2312-119-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/2312-121-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/3008-40-0x0000000007C00000-0x0000000007C1E000-memory.dmpFilesize
120KB
-
memory/3008-5-0x0000000003020000-0x0000000003030000-memory.dmpFilesize
64KB
-
memory/3008-45-0x0000000007D20000-0x0000000007D31000-memory.dmpFilesize
68KB
-
memory/3008-46-0x0000000007D60000-0x0000000007D6E000-memory.dmpFilesize
56KB
-
memory/3008-47-0x0000000007D80000-0x0000000007D94000-memory.dmpFilesize
80KB
-
memory/3008-48-0x0000000007DD0000-0x0000000007DEA000-memory.dmpFilesize
104KB
-
memory/3008-49-0x0000000007DC0000-0x0000000007DC8000-memory.dmpFilesize
32KB
-
memory/3008-52-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/3008-43-0x0000000003020000-0x0000000003030000-memory.dmpFilesize
64KB
-
memory/3008-42-0x0000000007D10000-0x0000000007D1A000-memory.dmpFilesize
40KB
-
memory/3008-3-0x00000000050B0000-0x00000000050E6000-memory.dmpFilesize
216KB
-
memory/3008-4-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/3008-44-0x0000000007E20000-0x0000000007EB6000-memory.dmpFilesize
600KB
-
memory/3008-6-0x0000000003020000-0x0000000003030000-memory.dmpFilesize
64KB
-
memory/3008-7-0x0000000005720000-0x0000000005D48000-memory.dmpFilesize
6.2MB
-
memory/3008-8-0x0000000005660000-0x0000000005682000-memory.dmpFilesize
136KB
-
memory/3008-9-0x0000000005E50000-0x0000000005EB6000-memory.dmpFilesize
408KB
-
memory/3008-10-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/3008-20-0x0000000006040000-0x0000000006394000-memory.dmpFilesize
3.3MB
-
memory/3008-21-0x0000000006640000-0x000000000665E000-memory.dmpFilesize
120KB
-
memory/3008-22-0x0000000006690000-0x00000000066DC000-memory.dmpFilesize
304KB
-
memory/3008-23-0x0000000006BC0000-0x0000000006C04000-memory.dmpFilesize
272KB
-
memory/3008-24-0x0000000007960000-0x00000000079D6000-memory.dmpFilesize
472KB
-
memory/3008-26-0x0000000007A00000-0x0000000007A1A000-memory.dmpFilesize
104KB
-
memory/3008-25-0x0000000008060000-0x00000000086DA000-memory.dmpFilesize
6.5MB
-
memory/3008-27-0x000000007FD20000-0x000000007FD30000-memory.dmpFilesize
64KB
-
memory/3008-29-0x0000000070910000-0x000000007095C000-memory.dmpFilesize
304KB
-
memory/3008-41-0x0000000007C20000-0x0000000007CC3000-memory.dmpFilesize
652KB
-
memory/3008-30-0x0000000070A90000-0x0000000070DE4000-memory.dmpFilesize
3.3MB
-
memory/3008-28-0x0000000007BC0000-0x0000000007BF2000-memory.dmpFilesize
200KB
-
memory/3864-53-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3864-57-0x0000000006670000-0x0000000006F5B000-memory.dmpFilesize
8.9MB
-
memory/3864-1-0x0000000004AC0000-0x0000000004EC7000-memory.dmpFilesize
4.0MB
-
memory/3864-2-0x0000000006670000-0x0000000006F5B000-memory.dmpFilesize
8.9MB
-
memory/3876-295-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-274-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-283-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-280-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-259-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-298-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-292-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-286-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-257-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-271-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-277-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-289-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3876-261-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4392-268-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4564-124-0x00000000029A0000-0x00000000029B0000-memory.dmpFilesize
64KB
-
memory/4564-137-0x00000000711B0000-0x0000000071504000-memory.dmpFilesize
3.3MB
-
memory/4564-122-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/4564-123-0x00000000029A0000-0x00000000029B0000-memory.dmpFilesize
64KB
-
memory/4564-136-0x0000000070A10000-0x0000000070A5C000-memory.dmpFilesize
304KB
-
memory/5112-73-0x0000000070A10000-0x0000000070A5C000-memory.dmpFilesize
304KB
-
memory/5112-59-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/5112-71-0x0000000005E40000-0x0000000005E8C000-memory.dmpFilesize
304KB
-
memory/5112-70-0x0000000005A10000-0x0000000005D64000-memory.dmpFilesize
3.3MB
-
memory/5112-58-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/5112-74-0x0000000070B90000-0x0000000070EE4000-memory.dmpFilesize
3.3MB
-
memory/5112-60-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/5112-72-0x000000007F7E0000-0x000000007F7F0000-memory.dmpFilesize
64KB
-
memory/5112-85-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/5112-86-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/5112-84-0x0000000006FC0000-0x0000000007063000-memory.dmpFilesize
652KB
-
memory/5112-87-0x00000000072E0000-0x00000000072F1000-memory.dmpFilesize
68KB
-
memory/5112-88-0x0000000007330000-0x0000000007344000-memory.dmpFilesize
80KB
-
memory/5112-91-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB