Analysis
- max time kernel
22s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
25/04/2024, 21:44
General
- Target 77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2.exe
- Size 4.1MB
- Sample240425-1le8safe24
- SHA256 77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 18 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2.exe"C:\Users\Admin\AppData\Local\Temp\77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2.exe"C:\Users\Admin\AppData\Local\Temp\77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2.exe"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_etdjenai.k0a.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
windefender.exe
memory/72-253-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/72-259-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2328-69-0x0000000074060000-0x0000000074811000-memory.dmp
memory/2328-71-0x0000000070520000-0x0000000070877000-memory.dmp
memory/2328-59-0x0000000003300000-0x0000000003310000-memory.dmp
memory/2328-60-0x0000000006170000-0x00000000064C7000-memory.dmp
memory/2328-70-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/2328-58-0x0000000003300000-0x0000000003310000-memory.dmp
memory/2328-81-0x0000000003300000-0x0000000003310000-memory.dmp
memory/2328-80-0x0000000007890000-0x0000000007934000-memory.dmp
memory/2328-82-0x0000000007BD0000-0x0000000007BE1000-memory.dmp
memory/2328-83-0x0000000007C20000-0x0000000007C35000-memory.dmp
memory/2328-86-0x0000000074060000-0x0000000074811000-memory.dmp
memory/3308-249-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3312-101-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/3312-89-0x0000000074060000-0x0000000074811000-memory.dmp
memory/3312-102-0x0000000070450000-0x00000000707A7000-memory.dmp
memory/3312-114-0x0000000074060000-0x0000000074811000-memory.dmp
memory/3312-112-0x0000000005370000-0x0000000005380000-memory.dmp
memory/3312-99-0x0000000005370000-0x0000000005380000-memory.dmp
memory/3312-90-0x0000000005370000-0x0000000005380000-memory.dmp
memory/4268-270-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-275-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-272-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-267-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-149-0x0000000003B00000-0x0000000003F00000-memory.dmp
memory/4268-264-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-175-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-261-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-257-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-242-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-254-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4268-251-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4364-27-0x0000000070450000-0x00000000707A7000-memory.dmp
memory/4364-23-0x0000000006590000-0x00000000065D6000-memory.dmp
memory/4364-4-0x0000000002B10000-0x0000000002B46000-memory.dmp
memory/4364-5-0x0000000074060000-0x0000000074811000-memory.dmp
memory/4364-6-0x0000000002EE0000-0x0000000002EF0000-memory.dmp
memory/4364-7-0x0000000002EE0000-0x0000000002EF0000-memory.dmp
memory/4364-8-0x0000000005530000-0x0000000005B5A000-memory.dmp
memory/4364-9-0x0000000005140000-0x0000000005162000-memory.dmp
memory/4364-49-0x0000000074060000-0x0000000074811000-memory.dmp
memory/4364-46-0x00000000076D0000-0x00000000076D8000-memory.dmp
memory/4364-45-0x00000000076B0000-0x00000000076CA000-memory.dmp
memory/4364-44-0x0000000007660000-0x0000000007675000-memory.dmp
memory/4364-43-0x0000000007650000-0x000000000765E000-memory.dmp
memory/4364-42-0x0000000007600000-0x0000000007611000-memory.dmp
memory/4364-10-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/4364-41-0x00000000076F0000-0x0000000007786000-memory.dmp
memory/4364-40-0x00000000075E0000-0x00000000075EA000-memory.dmp
memory/4364-11-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/4364-20-0x0000000005BB0000-0x0000000005F07000-memory.dmp
memory/4364-21-0x0000000005FD0000-0x0000000005FEE000-memory.dmp
memory/4364-22-0x0000000006020000-0x000000000606C000-memory.dmp
memory/4364-25-0x0000000007410000-0x0000000007444000-memory.dmp
memory/4364-24-0x000000007F780000-0x000000007F790000-memory.dmp
memory/4364-26-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/4364-37-0x0000000007470000-0x0000000007514000-memory.dmp
memory/4364-36-0x0000000007450000-0x000000000746E000-memory.dmp
memory/4364-39-0x00000000075A0000-0x00000000075BA000-memory.dmp
memory/4364-38-0x0000000007BE0000-0x000000000825A000-memory.dmp
memory/4600-52-0x0000000003730000-0x0000000003B35000-memory.dmp
memory/4600-1-0x0000000003730000-0x0000000003B35000-memory.dmp
memory/4600-2-0x00000000052E0000-0x0000000005BCB000-memory.dmp
memory/4600-3-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4600-53-0x00000000052E0000-0x0000000005BCB000-memory.dmp
memory/4600-51-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4820-128-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4820-55-0x0000000003760000-0x0000000003B5D000-memory.dmp
memory/4820-56-0x0000000005300000-0x0000000005BEB000-memory.dmp
memory/4820-144-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4820-57-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4820-111-0x0000000003760000-0x0000000003B5D000-memory.dmp
memory/4820-87-0x0000000000400000-0x0000000003005000-memory.dmp
memory/4956-115-0x0000000074060000-0x0000000074811000-memory.dmp
memory/4956-117-0x00000000056A0000-0x00000000059F7000-memory.dmp
memory/4956-129-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/4956-126-0x0000000004760000-0x0000000004770000-memory.dmp
memory/4956-116-0x0000000004760000-0x0000000004770000-memory.dmp
memory/4956-130-0x0000000070500000-0x0000000070857000-memory.dmp
memory/4956-140-0x0000000074060000-0x0000000074811000-memory.dmp