glupteba | dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248

General

Target

dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe
Size

4.2MB
MD5

1675ad3eadb63a45bd70ef2832a9e961
SHA1

3e8dee32889f96950b380c8bbdc2ec1d60b20aa6
SHA256

dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248
SHA512

00ef6585174b73f3b8b73541a289a797b6aa71b5f3aaff1a5eb376f9c83655fc599bd3e4c541bd0c6bbd0de222d2684bc6fc77c28335f6874acd42180901f2bd
SSDEEP

98304:5lPNnLMcliXgk6mZUGEiVLqbbhuqLV4AlEjP7Z:5lP9LMc0wkDbEiV0LVIt

Score

10^/10

glupteba dropper loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3888-2-0x0000000005270000-0x0000000005B5B000-memory.dmp	family_glupteba
behavioral2/memory/3888-3-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral2/memory/3888-51-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral2/memory/3888-52-0x0000000005270000-0x0000000005B5B000-memory.dmp	family_glupteba
behavioral2/memory/2260-54-0x0000000003660000-0x0000000003A60000-memory.dmp	family_glupteba

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exedc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe

pid	process
4484	powershell.exe
4484	powershell.exe
3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe
3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exedc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe

description	pid	process
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe
Token: SeImpersonatePrivilege	3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe

description	pid	process	target process
PID 3888 wrote to memory of 4484	3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe	powershell.exe
PID 3888 wrote to memory of 4484	3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe	powershell.exe
PID 3888 wrote to memory of 4484	3888	dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe
"C:\Users\Admin\AppData\Local\Temp\dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Users\Admin\AppData\Local\Temp\dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe
"C:\Users\Admin\AppData\Local\Temp\dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248.exe"
2⤵
PID:2260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrxn5ujp.p2i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2260-55-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/2260-54-0x0000000003660000-0x0000000003A60000-memory.dmp

Filesize
4.0MB

Download
memory/3888-2-0x0000000005270000-0x0000000005B5B000-memory.dmp

Filesize
8.9MB

Download
memory/3888-3-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3888-52-0x0000000005270000-0x0000000005B5B000-memory.dmp

Filesize
8.9MB

Download
memory/3888-51-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3888-1-0x00000000036D0000-0x0000000003ACD000-memory.dmp

Filesize
4.0MB

Download
memory/4484-25-0x00000000075E0000-0x0000000007614000-memory.dmp

Filesize
208KB

Download
memory/4484-39-0x0000000007DB0000-0x000000000842A000-memory.dmp

Filesize
6.5MB

Download
memory/4484-11-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/4484-9-0x00000000052F0000-0x0000000005312000-memory.dmp

Filesize
136KB

Download
memory/4484-20-0x0000000005CE0000-0x0000000006037000-memory.dmp

Filesize
3.3MB

Download
memory/4484-21-0x00000000061B0000-0x00000000061CE000-memory.dmp

Filesize
120KB

Download
memory/4484-22-0x00000000061F0000-0x000000000623C000-memory.dmp

Filesize
304KB

Download
memory/4484-23-0x0000000006780000-0x00000000067C6000-memory.dmp

Filesize
280KB

Download
memory/4484-24-0x000000007F920000-0x000000007F930000-memory.dmp

Filesize
64KB

Download
memory/4484-26-0x0000000070580000-0x00000000705CC000-memory.dmp

Filesize
304KB

Download
memory/4484-8-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4484-27-0x0000000070710000-0x0000000070A67000-memory.dmp

Filesize
3.3MB

Download
memory/4484-36-0x0000000007620000-0x000000000763E000-memory.dmp

Filesize
120KB

Download
memory/4484-38-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4484-37-0x0000000007640000-0x00000000076E4000-memory.dmp

Filesize
656KB

Download
memory/4484-10-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/4484-40-0x0000000007770000-0x000000000778A000-memory.dmp

Filesize
104KB

Download
memory/4484-41-0x00000000077B0000-0x00000000077BA000-memory.dmp

Filesize
40KB

Download
memory/4484-42-0x0000000007870000-0x0000000007906000-memory.dmp

Filesize
600KB

Download
memory/4484-43-0x00000000077E0000-0x00000000077F1000-memory.dmp

Filesize
68KB

Download
memory/4484-44-0x0000000007820000-0x000000000782E000-memory.dmp

Filesize
56KB

Download
memory/4484-45-0x0000000007830000-0x0000000007845000-memory.dmp

Filesize
84KB

Download
memory/4484-46-0x0000000007930000-0x000000000794A000-memory.dmp

Filesize
104KB

Download
memory/4484-47-0x0000000007920000-0x0000000007928000-memory.dmp

Filesize
32KB

Download
memory/4484-50-0x0000000074310000-0x0000000074AC1000-memory.dmp

Filesize
7.7MB

Download
memory/4484-7-0x0000000005410000-0x0000000005A3A000-memory.dmp

Filesize
6.2MB

Download
memory/4484-6-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4484-4-0x0000000074310000-0x0000000074AC1000-memory.dmp

Filesize
7.7MB

Download
memory/4484-5-0x0000000004CF0000-0x0000000004D26000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads