Analysis

  • max time kernel
    7s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 15:25

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-23T15:25:28Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_15-dirty.qcow2\"}"

General

  • Target

    b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c.exe

  • Size

    4.2MB

  • MD5

    1444a1b7a62fb4126737fb73a3fe9209

  • SHA1

    784b5604894c97482476baee97c0627490b8efb3

  • SHA256

    b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c

  • SHA512

    f161d0a946d4bf176ce26b67c76258a0b7d3ca9568e8e09839de483e0b3ab5deb531882c9fed5fcf1a5f293186fe09a500aa98ae8572dfefb9e1314de131ab43

  • SSDEEP

    98304:5YLCMptDmsu+9iprwjFTOTj/zIJhxobwLXF8FmbNEpdL19bKn:tkDFH9njBOTWhxocJmmbsdxhK

Score
10/10

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c.exe"
    1⤵
      PID:4688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
          PID:388
        • C:\Users\Admin\AppData\Local\Temp\b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c.exe
          "C:\Users\Admin\AppData\Local\Temp\b2e5e9967672a3f2394e052e1ca0caec6e990d535a33eefdb0544f90631d648c.exe"
          2⤵
            PID:688
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:3944

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ax2bz21n.dea.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/388-42-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

            Filesize

            64KB

          • memory/388-9-0x0000000005E50000-0x0000000005EB6000-memory.dmp

            Filesize

            408KB

          • memory/388-28-0x0000000007AC0000-0x0000000007AF2000-memory.dmp

            Filesize

            200KB

          • memory/388-6-0x00000000056B0000-0x0000000005CD8000-memory.dmp

            Filesize

            6.2MB

          • memory/388-7-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

            Filesize

            64KB

          • memory/388-5-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

            Filesize

            64KB

          • memory/388-8-0x0000000005580000-0x00000000055A2000-memory.dmp

            Filesize

            136KB

          • memory/388-40-0x0000000007B00000-0x0000000007B1E000-memory.dmp

            Filesize

            120KB

          • memory/388-53-0x0000000074B80000-0x0000000075330000-memory.dmp

            Filesize

            7.7MB

          • memory/388-10-0x0000000005EC0000-0x0000000005F26000-memory.dmp

            Filesize

            408KB

          • memory/388-20-0x0000000006030000-0x0000000006384000-memory.dmp

            Filesize

            3.3MB

          • memory/388-21-0x0000000006540000-0x000000000655E000-memory.dmp

            Filesize

            120KB

          • memory/388-41-0x0000000007B20000-0x0000000007BC3000-memory.dmp

            Filesize

            652KB

          • memory/388-23-0x0000000006A80000-0x0000000006AC4000-memory.dmp

            Filesize

            272KB

          • memory/388-24-0x0000000007660000-0x00000000076D6000-memory.dmp

            Filesize

            472KB

          • memory/388-26-0x0000000007900000-0x000000000791A000-memory.dmp

            Filesize

            104KB

          • memory/388-25-0x0000000007F60000-0x00000000085DA000-memory.dmp

            Filesize

            6.5MB

          • memory/388-29-0x0000000070A20000-0x0000000070A6C000-memory.dmp

            Filesize

            304KB

          • memory/388-30-0x0000000070BA0000-0x0000000070EF4000-memory.dmp

            Filesize

            3.3MB

          • memory/388-50-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

            Filesize

            32KB

          • memory/388-22-0x0000000006570000-0x00000000065BC000-memory.dmp

            Filesize

            304KB

          • memory/388-3-0x0000000002F50000-0x0000000002F86000-memory.dmp

            Filesize

            216KB

          • memory/388-4-0x0000000074B80000-0x0000000075330000-memory.dmp

            Filesize

            7.7MB

          • memory/388-43-0x0000000007C10000-0x0000000007C1A000-memory.dmp

            Filesize

            40KB

          • memory/388-44-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

            Filesize

            64KB

          • memory/388-45-0x0000000007CD0000-0x0000000007D66000-memory.dmp

            Filesize

            600KB

          • memory/388-46-0x0000000007C30000-0x0000000007C41000-memory.dmp

            Filesize

            68KB

          • memory/388-27-0x000000007F920000-0x000000007F930000-memory.dmp

            Filesize

            64KB

          • memory/388-47-0x0000000007C70000-0x0000000007C7E000-memory.dmp

            Filesize

            56KB

          • memory/388-48-0x0000000007C80000-0x0000000007C94000-memory.dmp

            Filesize

            80KB

          • memory/388-49-0x0000000007D70000-0x0000000007D8A000-memory.dmp

            Filesize

            104KB

          • memory/688-56-0x0000000004810000-0x0000000004C0E000-memory.dmp

            Filesize

            4.0MB

          • memory/3944-58-0x0000000074C20000-0x00000000753D0000-memory.dmp

            Filesize

            7.7MB

          • memory/3944-60-0x0000000005590000-0x00000000055A0000-memory.dmp

            Filesize

            64KB

          • memory/3944-59-0x0000000005590000-0x00000000055A0000-memory.dmp

            Filesize

            64KB

          • memory/3944-70-0x0000000006350000-0x00000000066A4000-memory.dmp

            Filesize

            3.3MB

          • memory/3944-71-0x0000000006DD0000-0x0000000006E1C000-memory.dmp

            Filesize

            304KB

          • memory/3944-72-0x000000007F380000-0x000000007F390000-memory.dmp

            Filesize

            64KB

          • memory/4688-1-0x00000000049B0000-0x0000000004DB4000-memory.dmp

            Filesize

            4.0MB

          • memory/4688-2-0x0000000006560000-0x0000000006E4B000-memory.dmp

            Filesize

            8.9MB

          • memory/4688-55-0x0000000000400000-0x0000000004426000-memory.dmp

            Filesize

            64.1MB

          • memory/4688-57-0x0000000006560000-0x0000000006E4B000-memory.dmp

            Filesize

            8.9MB