Analysis

  • max time kernel
    12s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/05/2024, 19:28

General

  • Target

    eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e.exe

  • Size

    4.1MB

  • MD5

    46037805a06c7829deb38acc16a8a71e

  • SHA1

    826d302a240e6cfb4d865150eb833e2fb195e09d

  • SHA256

    eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e

  • SHA512

    942e362d82f1a6f53f09e3800c64c557bc54778d29bf6f8166d63c8440b1aaa8604bf9e73f8270c4f754079fa8cb7a02d5f1e9dcc20fa0b21bd17429f383bc8f

  • SSDEEP

    98304:VwBco1salv4p8AdbboIKOJLJ1nO5Zld79mTpy:VwqoWyv4yANjKQa7oU

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e.exe
    "C:\Users\Admin\AppData\Local\Temp\eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Users\Admin\AppData\Local\Temp\eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e.exe
      "C:\Users\Admin\AppData\Local\Temp\eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e.exe"
      2⤵
        PID:2896
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4188
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          3⤵
            PID:3852
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:2864
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3664
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1660
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            3⤵
              PID:2548
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2140
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:3164
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                4⤵
                  PID:3912
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1100
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2084
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  4⤵
                    PID:936
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • Creates scheduled task(s)
                    PID:2488
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    4⤵
                      PID:1440
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        5⤵
                          PID:4988
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            6⤵
                            • Launches sc.exe
                            PID:5044
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                    PID:4328

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fydh0egp.ysm.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                          Filesize

                          281KB

                          MD5

                          d98e33b66343e7c96158444127a117f6

                          SHA1

                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                          SHA256

                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                          SHA512

                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                          Filesize

                          2KB

                          MD5

                          d0c46cad6c0778401e21910bd6b56b70

                          SHA1

                          7be418951ea96326aca445b8dfe449b2bfa0dca6

                          SHA256

                          9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                          SHA512

                          057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                          Filesize

                          19KB

                          MD5

                          3dcbb6df70404f7255d4e56178f23b9b

                          SHA1

                          354bdde9cd2f7093c0fc43a53f20ffb9bea47a6a

                          SHA256

                          2c65935b9aadac08ea5edb880c62563ebc6ca13b01e262bf1520dba1225790c1

                          SHA512

                          18adf0b8dfd6668a68b34eae4f71df82f2de77e8dff353803596acee9f221c4e76c78b3ea6db7ec3a263499e788034df369305e87d62cf7bc96795dfaa583329

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                          Filesize

                          19KB

                          MD5

                          cd40db2af3080e46dcf35f72ffa30848

                          SHA1

                          591332512b805bc67b707d1f2f52ce58e7bdc16a

                          SHA256

                          23cce8a07295ddc3e7867300424ce40620af02c778966c4f78ba08950c827a00

                          SHA512

                          33491523ac3fe487bbc87a60704e1c82f32f7290697d5d9c8af4f100afa8aee534481215227f933b76ac2f48d46551808ae98ee7901d8ea28ae09bbf1f531c73

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                          Filesize

                          19KB

                          MD5

                          c36adf6fa1eeb88d4b1ed3971f82214d

                          SHA1

                          261735aeaeecbe2f82ab93b0bb49635a33da3e92

                          SHA256

                          e0ff593427178192c55e38476f3f7b395fd9a682fbf3c9f6c715938b33b84b70

                          SHA512

                          264753b5b9e45af82b492556ea2aa874b7a41c81810b316fc8721c14f531cdc42b7a469fd9f6e6abb6b0dcf3d5e9e05c50b92ff0c47a041b7b3edeb1ef770443

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                          Filesize

                          19KB

                          MD5

                          dffbe841e6800b6de96792f83c4fb21e

                          SHA1

                          162c80dbb87d36eccacc14b1647e9986a749cf6f

                          SHA256

                          9f7440af47958385af8455d1934571c3f592b733398487dfc8a80ba0dd447eea

                          SHA512

                          a09a0d2b3ea15575a8e066d773ca720752047bb0dd0058fa036cc499998c3ef1c028f6e89c52a8313b68ee4331e9a57fc91fe6aa0301e9f548ac8f2db21d4f80

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                          Filesize

                          19KB

                          MD5

                          847cca837a682a31a4a08ad796bd64ca

                          SHA1

                          0435607f2dddb35656f42bad47c87c700a7d42a7

                          SHA256

                          1af9f13b631929468df518499e127de3738864dafb250515194af7e86305e4c5

                          SHA512

                          bdb57ef9548ae9c3323321e8f4061c8f520a5393898e87c0e2ea35bf8ec541c99110c128cce5b132b31a6a1478baaf01b61b93a2eed27cdeed64a9063ac94aa4

                        • C:\Windows\rss\csrss.exe

                          Filesize

                          4.1MB

                          MD5

                          46037805a06c7829deb38acc16a8a71e

                          SHA1

                          826d302a240e6cfb4d865150eb833e2fb195e09d

                          SHA256

                          eeb8433e8ea2b93bff79946650ba4c20d18a8b1f5fa357680f6f690d59e9484e

                          SHA512

                          942e362d82f1a6f53f09e3800c64c557bc54778d29bf6f8166d63c8440b1aaa8604bf9e73f8270c4f754079fa8cb7a02d5f1e9dcc20fa0b21bd17429f383bc8f

                        • C:\Windows\windefender.exe

                          Filesize

                          2.0MB

                          MD5

                          8e67f58837092385dcf01e8a2b4f5783

                          SHA1

                          012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                          SHA256

                          166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                          SHA512

                          40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                        • memory/904-26-0x0000000070340000-0x0000000070697000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/904-39-0x0000000007640000-0x000000000764A000-memory.dmp

                          Filesize

                          40KB

                        • memory/904-20-0x0000000005B60000-0x0000000005EB7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/904-21-0x0000000006050000-0x000000000606E000-memory.dmp

                          Filesize

                          120KB

                        • memory/904-22-0x00000000061B0000-0x00000000061FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/904-23-0x0000000006600000-0x0000000006646000-memory.dmp

                          Filesize

                          280KB

                        • memory/904-24-0x0000000007460000-0x0000000007494000-memory.dmp

                          Filesize

                          208KB

                        • memory/904-25-0x00000000701B0000-0x00000000701FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/904-12-0x0000000073F40000-0x00000000746F1000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/904-36-0x00000000074E0000-0x0000000007584000-memory.dmp

                          Filesize

                          656KB

                        • memory/904-35-0x00000000074C0000-0x00000000074DE000-memory.dmp

                          Filesize

                          120KB

                        • memory/904-38-0x0000000007600000-0x000000000761A000-memory.dmp

                          Filesize

                          104KB

                        • memory/904-37-0x0000000007C40000-0x00000000082BA000-memory.dmp

                          Filesize

                          6.5MB

                        • memory/904-8-0x0000000005220000-0x0000000005242000-memory.dmp

                          Filesize

                          136KB

                        • memory/904-40-0x0000000007750000-0x00000000077E6000-memory.dmp

                          Filesize

                          600KB

                        • memory/904-41-0x0000000007660000-0x0000000007671000-memory.dmp

                          Filesize

                          68KB

                        • memory/904-42-0x00000000076B0000-0x00000000076BE000-memory.dmp

                          Filesize

                          56KB

                        • memory/904-43-0x00000000076C0000-0x00000000076D5000-memory.dmp

                          Filesize

                          84KB

                        • memory/904-44-0x0000000007710000-0x000000000772A000-memory.dmp

                          Filesize

                          104KB

                        • memory/904-46-0x0000000007730000-0x0000000007738000-memory.dmp

                          Filesize

                          32KB

                        • memory/904-10-0x0000000005AF0000-0x0000000005B56000-memory.dmp

                          Filesize

                          408KB

                        • memory/904-49-0x0000000073F40000-0x00000000746F1000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/904-9-0x0000000005A80000-0x0000000005AE6000-memory.dmp

                          Filesize

                          408KB

                        • memory/904-7-0x0000000073F40000-0x00000000746F1000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/904-6-0x0000000005260000-0x000000000588A000-memory.dmp

                          Filesize

                          6.2MB

                        • memory/904-5-0x0000000004B90000-0x0000000004BC6000-memory.dmp

                          Filesize

                          216KB

                        • memory/904-4-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

                          Filesize

                          4KB

                        • memory/1100-173-0x0000000007940000-0x00000000079E4000-memory.dmp

                          Filesize

                          656KB

                        • memory/1100-157-0x0000000006120000-0x0000000006477000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/1100-175-0x00000000064F0000-0x0000000006505000-memory.dmp

                          Filesize

                          84KB

                        • memory/1100-174-0x0000000007CB0000-0x0000000007CC1000-memory.dmp

                          Filesize

                          68KB

                        • memory/1100-163-0x00000000700D0000-0x000000007011C000-memory.dmp

                          Filesize

                          304KB

                        • memory/1100-164-0x0000000070320000-0x0000000070677000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/1100-162-0x0000000006710000-0x000000000675C000-memory.dmp

                          Filesize

                          304KB

                        • memory/1440-211-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/1440-209-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/1660-109-0x0000000005AA0000-0x0000000005DF7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/1660-112-0x00000000703E0000-0x0000000070737000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/1660-111-0x00000000701B0000-0x00000000701FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/2084-187-0x00000000700D0000-0x000000007011C000-memory.dmp

                          Filesize

                          304KB

                        • memory/2084-188-0x0000000070270000-0x00000000705C7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/2084-185-0x00000000063C0000-0x0000000006717000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/2140-140-0x0000000070330000-0x0000000070687000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/2140-139-0x00000000701B0000-0x00000000701FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/2140-137-0x0000000006370000-0x00000000066C7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/2548-213-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-204-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-151-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-237-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-234-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-231-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-228-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-225-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-222-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-219-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2548-216-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/2896-126-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/3024-1-0x0000000003390000-0x000000000378F000-memory.dmp

                          Filesize

                          4.0MB

                        • memory/3024-75-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                        • memory/3024-52-0x0000000003390000-0x000000000378F000-memory.dmp

                          Filesize

                          4.0MB

                        • memory/3024-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                        • memory/3024-45-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/3024-51-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                        • memory/3024-2-0x0000000005030000-0x000000000591B000-memory.dmp

                          Filesize

                          8.9MB

                        • memory/3024-53-0x0000000005030000-0x000000000591B000-memory.dmp

                          Filesize

                          8.9MB

                        • memory/3664-90-0x00000000701B0000-0x00000000701FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/3664-91-0x0000000070B80000-0x0000000070ED7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/3664-88-0x00000000060F0000-0x0000000006447000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/4188-74-0x0000000007D30000-0x0000000007D41000-memory.dmp

                          Filesize

                          68KB

                        • memory/4188-73-0x00000000079E0000-0x0000000007A84000-memory.dmp

                          Filesize

                          656KB

                        • memory/4188-76-0x0000000007D80000-0x0000000007D95000-memory.dmp

                          Filesize

                          84KB

                        • memory/4188-64-0x0000000070400000-0x0000000070757000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/4188-59-0x0000000006280000-0x00000000065D7000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/4188-63-0x00000000701B0000-0x00000000701FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/4328-214-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/4328-220-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB