Analysis
-
max time kernel
0s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe
Resource
win10v2004-20240426-en
General
-
Target
2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe
-
Size
4.2MB
-
MD5
ce19e864fb67357cd83df6c24030d2f3
-
SHA1
6242690ecb707a5e381d8ee603566cffb4143895
-
SHA256
2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07
-
SHA512
f9e9c3ba2e7203b000ac5cbecb0540e54d757747c16b4727d6ff7dea72aec95ed414386535762f923004c4db0fcfe452a2c89593e034e9c35cf05de6d219cc2b
-
SSDEEP
98304:l2LBAEOKvJ0/zY80N0vVppdLThkoJY3pu9gQ6ORc3/EM9CU8vMe9:MtADCJ0L4N0vbpdLThJY3KtRc6kg
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2856-2-0x0000000006470000-0x0000000006D5B000-memory.dmp family_glupteba behavioral1/memory/2856-3-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/2856-50-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/2856-52-0x0000000006470000-0x0000000006D5B000-memory.dmp family_glupteba behavioral1/memory/3008-207-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-213-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-224-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-227-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-230-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-233-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-236-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-239-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-242-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-245-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-248-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-251-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-254-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral1/memory/4724-257-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1572 netsh.exe -
Processes:
resource yara_rule behavioral1/memory/3504-218-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx behavioral1/memory/3504-222-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1392-221-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1392-226-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1392-231-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4936 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 380 schtasks.exe 2864 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe"C:\Users\Admin\AppData\Local\Temp\2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
C:\Users\Admin\AppData\Local\Temp\2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe"C:\Users\Admin\AppData\Local\Temp\2b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_buuk1nc4.ykn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5471af0c6fc1f53d632cad621a3879781
SHA16fdeb99b3e5bb555e927d35eeca042074e8c1a84
SHA2564ca2f1c53b0f815442c485e4f7ea32fb5001cbfa44fc091bb512063519101e60
SHA512e46112de996f3d2434dfc56ee530ebf17f4f15cd9ac094accb377f6b67143a2c343782ba0957aa0fe220dbfc08af7626bdf73d58d06312858aa99222069bd81d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5989dc06a43d4f6061819af7ab4ba711f
SHA1f839cfac760fb0a4a9b67380ff54b6d495ca38fc
SHA2565b2ac4c378b44eb4fd7e418cb351090bd9afe4e4d26fefb5665c99717500135e
SHA51279d0a7f44d1738e806044f26f9edb1fe66dd3e6d43d0504058daba5e5ef56b7b87cbe3444582b3d46815822765ce2db33c5efd294f766893bdeb6b9acc58fc21
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a8de36233103379371e8417aeb332823
SHA1f1cb4e2cbbc47843054657911dd8b63fb00d8d13
SHA2568184e226dc150dc409b78ee86a3d9b60925981e2e9bd282c30453d4cd7e73641
SHA512829b2dc25b76723ac28d0f1eae92fadc49d24885e6c77b64a38f844d798f989458e924a3270c7647a8b2f0d5d83078cc9e9270418e0613802d0595808bac69e4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD552a6323085092c69814eb2544e075d21
SHA195edae5cab51011d01332bddd3b0186d2902dfd8
SHA25619084aaa239d147be1275089a4dfe54ed2035b9ced4f01cfc395d25eec490ebf
SHA5126a458f46f8ca0b8d7ab4d4c217b1740aca141029423408abb38ae4ccf19468e03a941f21678b1676b4a4066696078d01cb74351d9b532f43cae9b0d9e0e3f85f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5cd7e4dbd44cc86421a4a04e3a11867e5
SHA133b235dd918fd541177c6fca4664876d174bf410
SHA256faf16cde9a9eb044dab8c07ba630ddb0ace0562cb91f5ea42412076be982d3dd
SHA512b91644da402f0dbe6ac89ceb79ede1a185ad03902a75250a412e563284e39519e0213061bd9a207eceee4c25786c62e337e5bf4d79abb05495bf7ce983c013e8
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5ce19e864fb67357cd83df6c24030d2f3
SHA16242690ecb707a5e381d8ee603566cffb4143895
SHA2562b4bf32f9910486124b25c01ed7c837c9eb685c8d5171cf12786e74a536f5f07
SHA512f9e9c3ba2e7203b000ac5cbecb0540e54d757747c16b4727d6ff7dea72aec95ed414386535762f923004c4db0fcfe452a2c89593e034e9c35cf05de6d219cc2b
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/220-171-0x0000000071300000-0x0000000071654000-memory.dmpFilesize
3.3MB
-
memory/220-163-0x0000000006020000-0x0000000006374000-memory.dmpFilesize
3.3MB
-
memory/220-181-0x00000000078E0000-0x0000000007983000-memory.dmpFilesize
652KB
-
memory/220-170-0x0000000070B70000-0x0000000070BBC000-memory.dmpFilesize
304KB
-
memory/220-182-0x0000000007AE0000-0x0000000007AF1000-memory.dmpFilesize
68KB
-
memory/220-183-0x00000000063B0000-0x00000000063C4000-memory.dmpFilesize
80KB
-
memory/220-169-0x0000000006840000-0x000000000688C000-memory.dmpFilesize
304KB
-
memory/1392-221-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1392-226-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1392-231-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1596-22-0x0000000005F40000-0x0000000005F8C000-memory.dmpFilesize
304KB
-
memory/1596-40-0x00000000074E0000-0x0000000007583000-memory.dmpFilesize
652KB
-
memory/1596-29-0x0000000071330000-0x0000000071684000-memory.dmpFilesize
3.3MB
-
memory/1596-28-0x0000000070BF0000-0x0000000070C3C000-memory.dmpFilesize
304KB
-
memory/1596-42-0x00000000076E0000-0x0000000007776000-memory.dmpFilesize
600KB
-
memory/1596-43-0x00000000075E0000-0x00000000075F1000-memory.dmpFilesize
68KB
-
memory/1596-44-0x0000000007620000-0x000000000762E000-memory.dmpFilesize
56KB
-
memory/1596-45-0x0000000007640000-0x0000000007654000-memory.dmpFilesize
80KB
-
memory/1596-47-0x0000000007680000-0x0000000007688000-memory.dmpFilesize
32KB
-
memory/1596-46-0x0000000007690000-0x00000000076AA000-memory.dmpFilesize
104KB
-
memory/1596-49-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/1596-4-0x0000000002920000-0x0000000002956000-memory.dmpFilesize
216KB
-
memory/1596-5-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/1596-41-0x00000000075D0000-0x00000000075DA000-memory.dmpFilesize
40KB
-
memory/1596-6-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1596-7-0x00000000052D0000-0x00000000058F8000-memory.dmpFilesize
6.2MB
-
memory/1596-9-0x0000000005100000-0x0000000005166000-memory.dmpFilesize
408KB
-
memory/1596-39-0x00000000074C0000-0x00000000074DE000-memory.dmpFilesize
120KB
-
memory/1596-27-0x0000000007480000-0x00000000074B2000-memory.dmpFilesize
200KB
-
memory/1596-25-0x0000000007940000-0x0000000007FBA000-memory.dmpFilesize
6.5MB
-
memory/1596-26-0x00000000072C0000-0x00000000072DA000-memory.dmpFilesize
104KB
-
memory/1596-24-0x0000000007240000-0x00000000072B6000-memory.dmpFilesize
472KB
-
memory/1596-23-0x0000000006470000-0x00000000064B4000-memory.dmpFilesize
272KB
-
memory/1596-21-0x0000000005F00000-0x0000000005F1E000-memory.dmpFilesize
120KB
-
memory/1596-20-0x0000000005970000-0x0000000005CC4000-memory.dmpFilesize
3.3MB
-
memory/1596-8-0x0000000004F60000-0x0000000004F82000-memory.dmpFilesize
136KB
-
memory/1596-10-0x0000000005900000-0x0000000005966000-memory.dmpFilesize
408KB
-
memory/2856-1-0x00000000047C0000-0x0000000004BC4000-memory.dmpFilesize
4.0MB
-
memory/2856-52-0x0000000006470000-0x0000000006D5B000-memory.dmpFilesize
8.9MB
-
memory/2856-50-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/2856-3-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/2856-2-0x0000000006470000-0x0000000006D5B000-memory.dmpFilesize
8.9MB
-
memory/3008-207-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/3504-222-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3504-218-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4424-63-0x00000000067F0000-0x000000000683C000-memory.dmpFilesize
304KB
-
memory/4424-77-0x0000000007D10000-0x0000000007D24000-memory.dmpFilesize
80KB
-
memory/4424-58-0x0000000006130000-0x0000000006484000-memory.dmpFilesize
3.3MB
-
memory/4424-65-0x0000000071490000-0x00000000717E4000-memory.dmpFilesize
3.3MB
-
memory/4424-75-0x0000000007980000-0x0000000007A23000-memory.dmpFilesize
652KB
-
memory/4424-64-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/4424-76-0x0000000007CC0000-0x0000000007CD1000-memory.dmpFilesize
68KB
-
memory/4520-154-0x0000000006FE0000-0x0000000007083000-memory.dmpFilesize
652KB
-
memory/4520-136-0x0000000005670000-0x00000000059C4000-memory.dmpFilesize
3.3MB
-
memory/4520-142-0x0000000005DC0000-0x0000000005E0C000-memory.dmpFilesize
304KB
-
memory/4520-144-0x00000000713F0000-0x0000000071744000-memory.dmpFilesize
3.3MB
-
memory/4520-156-0x0000000005B70000-0x0000000005B84000-memory.dmpFilesize
80KB
-
memory/4520-143-0x0000000070C50000-0x0000000070C9C000-memory.dmpFilesize
304KB
-
memory/4520-155-0x00000000072D0000-0x00000000072E1000-memory.dmpFilesize
68KB
-
memory/4636-196-0x0000000071300000-0x0000000071654000-memory.dmpFilesize
3.3MB
-
memory/4636-195-0x0000000070B70000-0x0000000070BBC000-memory.dmpFilesize
304KB
-
memory/4724-239-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-245-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-233-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-236-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-224-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-254-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-227-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-230-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-257-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-251-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-248-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-213-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4724-242-0x0000000000400000-0x0000000004420000-memory.dmpFilesize
64.1MB
-
memory/4992-114-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/4992-112-0x0000000005F80000-0x00000000062D4000-memory.dmpFilesize
3.3MB
-
memory/4992-115-0x0000000070E70000-0x00000000711C4000-memory.dmpFilesize
3.3MB
-
memory/5100-91-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/5100-92-0x0000000071490000-0x00000000717E4000-memory.dmpFilesize
3.3MB