glupteba | 4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d

General

Target

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Size

4.2MB
MD5

5b412e8d19ec18d694548112832773c5
SHA1

b1dc18da9bd9326e7069c77246c7718352a52582
SHA256

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d
SHA512

67ba5641d2865907ea39df1f917429c0151970e56e20dc8880e959bc114008cccf0d1a27cbace44ec6a81963d38d42cb1f5950e0cadeb261b19583c88f436772
SSDEEP

98304:PamOmyh13YwSD+iffg9rOMOczucEEdNxQlfwo87Elwi0PG1g:PTy8Jy4o9ecZxQhwo8IinPG1g

Score

10^/10

glupteba dropper evasion loader persistence

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4808-2-0x0000000003F80000-0x000000000486B000-memory.dmp	family_glupteba
behavioral1/memory/4808-3-0x0000000000400000-0x0000000001DFB000-memory.dmp	family_glupteba
behavioral1/memory/4808-83-0x0000000003F80000-0x000000000486B000-memory.dmp	family_glupteba
behavioral1/memory/4808-80-0x0000000000400000-0x0000000001DFB000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4288 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

2604 csrss.exe

pid	process
4288	netsh.exe

pid	process
2604	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

Drops file in Windows directory 2 IoCs

Processes:

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
File opened for modification	C:\Windows\rss	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exe4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exepowershell.exe4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exepowershell.exepowershell.exe

pid	process
4600	powershell.exe
4600	powershell.exe
4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
2284	powershell.exe
2284	powershell.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
4476	powershell.exe
4476	powershell.exe
3216	powershell.exe
3216	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exe4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Token: SeImpersonatePrivilege	4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.execmd.exe

description	pid	process	target process
PID 4808 wrote to memory of 4600	4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 4808 wrote to memory of 4600	4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 4808 wrote to memory of 4600	4808	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 2284	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 2284	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 2284	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 2752	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	cmd.exe
PID 1584 wrote to memory of 2752	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	cmd.exe
PID 2752 wrote to memory of 4288	2752	cmd.exe	netsh.exe
PID 2752 wrote to memory of 4288	2752	cmd.exe	netsh.exe
PID 1584 wrote to memory of 4476	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 4476	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 4476	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 3216	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 3216	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 3216	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	powershell.exe
PID 1584 wrote to memory of 2604	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	csrss.exe
PID 1584 wrote to memory of 2604	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	csrss.exe
PID 1584 wrote to memory of 2604	1584	4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
"C:\Users\Admin\AppData\Local\Temp\4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Users\Admin\AppData\Local\Temp\4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe
"C:\Users\Admin\AppData\Local\Temp\4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
PID:2604

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kwkfdugs.prs.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
ea9a394b687ac29666a77e0ac7c790c0

SHA1
65711d70928ebf3a20af3c518b4c33bfa1229d3e

SHA256
c175d345a2dac9ce4cf657559e1946bb6e7146a69b0c39be5f9ed4f9ff1f3a25

SHA512
73a1102b4ab4ec74628e4fa9429ae4a84ba434e59911be7871ed0121d16e9020b9d0ec1032b7211bd3e4593d7e145d71e3f2543c38cda7da10335d1970935d9f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
818a6dc121d714e6e92afef41067280b

SHA1
920a9f41586342d1c54a57285874a37d4025cc06

SHA256
965ddf531b632f3573a6aa200e0d0d169aa40de510197e3984ad697d538110b1

SHA512
49f2a0a5599308b62a5ebccec56c2121fc2ec3306ece55ac865bc55c708c00cede1de78c6a3e26632921e850b6ab9682280770864a23addb3c7a3af03493896f

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
5b412e8d19ec18d694548112832773c5

SHA1
b1dc18da9bd9326e7069c77246c7718352a52582

SHA256
4b8ea28299d563187dbaeac5036d719b2bb8c0d176a56d73eed708d000b4a86d

SHA512
67ba5641d2865907ea39df1f917429c0151970e56e20dc8880e959bc114008cccf0d1a27cbace44ec6a81963d38d42cb1f5950e0cadeb261b19583c88f436772

Download Submit
memory/2284-79-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

Filesize
68KB

Download
memory/2284-81-0x0000000007E30000-0x0000000007E44000-memory.dmp

Filesize
80KB

Download
memory/2284-66-0x0000000006350000-0x00000000066A4000-memory.dmp

Filesize
3.3MB

Download
memory/2284-78-0x0000000007AB0000-0x0000000007B53000-memory.dmp

Filesize
652KB

Download
memory/2284-68-0x0000000070750000-0x0000000070AA4000-memory.dmp

Filesize
3.3MB

Download
memory/2284-67-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/3216-120-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/3216-121-0x0000000070770000-0x0000000070AC4000-memory.dmp

Filesize
3.3MB

Download
memory/4476-99-0x0000000070D50000-0x00000000710A4000-memory.dmp

Filesize
3.3MB

Download
memory/4476-98-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/4476-96-0x0000000005FF0000-0x0000000006344000-memory.dmp

Filesize
3.3MB

Download
memory/4600-22-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/4600-55-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-27-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/4600-29-0x000000007F850000-0x000000007F860000-memory.dmp

Filesize
64KB

Download
memory/4600-28-0x0000000007960000-0x0000000007992000-memory.dmp

Filesize
200KB

Download
memory/4600-30-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/4600-31-0x0000000070770000-0x0000000070AC4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-44-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4600-43-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4600-42-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4600-41-0x00000000079A0000-0x00000000079BE000-memory.dmp

Filesize
120KB

Download
memory/4600-45-0x00000000079C0000-0x0000000007A63000-memory.dmp

Filesize
652KB

Download
memory/4600-46-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

Filesize
40KB

Download
memory/4600-47-0x0000000007B70000-0x0000000007C06000-memory.dmp

Filesize
600KB

Download
memory/4600-48-0x0000000007AD0000-0x0000000007AE1000-memory.dmp

Filesize
68KB

Download
memory/4600-49-0x0000000007B10000-0x0000000007B1E000-memory.dmp

Filesize
56KB

Download
memory/4600-50-0x0000000007B20000-0x0000000007B34000-memory.dmp

Filesize
80KB

Download
memory/4600-51-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Filesize
104KB

Download
memory/4600-52-0x0000000007B60000-0x0000000007B68000-memory.dmp

Filesize
32KB

Download
memory/4600-26-0x0000000007DF0000-0x000000000846A000-memory.dmp

Filesize
6.5MB

Download
memory/4600-25-0x00000000074F0000-0x0000000007566000-memory.dmp

Filesize
472KB

Download
memory/4600-24-0x0000000006950000-0x0000000006994000-memory.dmp

Filesize
272KB

Download
memory/4600-23-0x0000000006410000-0x000000000645C000-memory.dmp

Filesize
304KB

Download
memory/4600-4-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Filesize
216KB

Download
memory/4600-21-0x0000000005DD0000-0x0000000006124000-memory.dmp

Filesize
3.3MB

Download
memory/4600-10-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download
memory/4600-5-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-6-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4600-7-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4600-11-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Filesize
408KB

Download
memory/4600-9-0x0000000005430000-0x0000000005452000-memory.dmp

Filesize
136KB

Download
memory/4600-8-0x0000000005570000-0x0000000005B98000-memory.dmp

Filesize
6.2MB

Download
memory/4808-80-0x0000000000400000-0x0000000001DFB000-memory.dmp

Filesize
26.0MB

Download
memory/4808-83-0x0000000003F80000-0x000000000486B000-memory.dmp

Filesize
8.9MB

Download
memory/4808-82-0x00000000021D0000-0x00000000025D6000-memory.dmp

Filesize
4.0MB

Download
memory/4808-1-0x00000000021D0000-0x00000000025D6000-memory.dmp

Filesize
4.0MB

Download
memory/4808-3-0x0000000000400000-0x0000000001DFB000-memory.dmp

Filesize
26.0MB

Download
memory/4808-2-0x0000000003F80000-0x000000000486B000-memory.dmp

Filesize
8.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads