Analysis
-
max time kernel
1s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
26/04/2024, 15:27
General
-
Target
6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6.exe
-
Size
4.2MB
-
MD5
72fb1e5a81d6bc87edc85783b07159d6
-
SHA1
b7668847b1af6aac7cefe99fcbff9787bb00eaad
-
SHA256
6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6
-
SHA512
397669dc85e175a5fec3af404482b629957494501ebe9f6e0f864db82c0e3a7fe475935c7a5092e4c860c8bad9b6bba8da16cbc35275f6e7275f67026094a49f
-
SSDEEP
98304:vGzsnCxKltbFvS+Z1vjUEQC5FD5MQIQIIS4sbbL4l:vG4nxAoLumFD5/IIFs2
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 18 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6.exe"C:\Users\Admin\AppData\Local\Temp\6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6.exe"C:\Users\Admin\AppData\Local\Temp\6133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 9642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
Filesize
19KB
MD5a9922ee2d1275ee90601b71b27a67a24
SHA11e7183bfb48c47243a0edc06349c8575682079d3
SHA25682962fc5409c67247a60b955035e593de66ee0434e0877850d655b89cb2c7513
SHA5123d66d1cbdbe5172094f96c599576d9de829d4241f713a08de3fda01e958db02d43316906df660976232b5a7b6afbdef6bed9bad04689a7703b5b00ed76b85487
-
Filesize
19KB
MD599f0f0337c01f1f9c13ad1ee44ccc5f1
SHA1d5d0616cf606b7169d05ad048935affe70f84263
SHA256f34b275ed0243722acda3d2cafcd109b164a7b2909e5fdd38a952e1de34a7c0b
SHA512c5eb8cf8bc6996f3ece235ce6a1988ff2f2bea50b421a8adf556b1f4dfad818582263e96e1b94bb63e7669bb42f596529a60323f98a741910e9004323a495eba
-
Filesize
19KB
MD50748fdea7eaa5a2dbe20d5826d60f935
SHA10fae0fbbe72507148844ac67dc6f812aa1330e4d
SHA256747730eef6278cef6b7937fe131d529a23d3b2a04dea331c3b5a73bc6fd67b1c
SHA512980df58bbf0c955ae05dbf5cc8b86a719559f109fea1fc080280a92579c3bbab28e9f6945fecc15abab25f9cc7066266c80bd7c980e4a07c4157ea6ca91a94e1
-
Filesize
19KB
MD5c8798a2635dd3b15a99a7b0b90ca1791
SHA1938244b10257592283f6c6e5ab87df161e076a16
SHA256d60f035068078fd053290e3af749f437e231ed23e3c32043718850e902fb62b5
SHA51296825912a8a38c4323691c4f5438122fb139950eff69ef4229d94cbb6e7e7895a0ab494da794786b5f6be8a3fc1d7926727f6c487f94cbfe1cf34c4b307d4073
-
Filesize
19KB
MD564b4a34f8a7dbe19bedc24b2410e6087
SHA10e5291fcc16bb47df7543a3785232cb74821f2da
SHA2566915fe48d7756bba9f55d488ac0f2b6b455df1c164fa15ca42dfa982d6718cb6
SHA5125cb78e51245b3bdb316fc470fb787886d06f167b3c883f50b533c2ac6912281f00b6e557b75bf97839da26a27f6cd0ba309d24797d4bd8037e67342ce1a1c53a
-
Filesize
4.2MB
MD572fb1e5a81d6bc87edc85783b07159d6
SHA1b7668847b1af6aac7cefe99fcbff9787bb00eaad
SHA2566133094ce5e6a92b7a49491efe69cef4a3aecad723e4b68a2c494bb3305bdea6
SHA512397669dc85e175a5fec3af404482b629957494501ebe9f6e0f864db82c0e3a7fe475935c7a5092e4c860c8bad9b6bba8da16cbc35275f6e7275f67026094a49f
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
84KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
84KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
64.1MB
-
Filesize
64.1MB
-
Filesize
8.9MB