Overview

overview

10

Static

static

3

468dcdb06c...18.exe

windows7-x64

10

468dcdb06c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

  • Size

    3.8MB

  • MD5

    468dcdb06c6733d0048a75360d52e1a4

  • SHA1

    eb1ad2cb3ddb7ac6560cf30cc7c286bd31989b1d

  • SHA256

    803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457

  • SHA512

    b78b6e303b4264727e157e559fcb947c7016087e453d4449001a5378297fc6306cec59aabec418f4a08e32101d7e74eca689a8801de451dbb76c5e696f4b0909

  • SSDEEP

    49152:ARuPPnhH53LFZLGbPG/mvDI7ZpZGyip8QCW3c7DfjqcPm93gBmXjKozboyujkXOa:AebSqmvkd6y/WcHjlm93kKKglWVJM

Score
10/10
gluptebadropperevasionloaderpersistence

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 14 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3364
    • C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:1840
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3456
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2436
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2620
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3924 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\rss\csrss.exe
      Filesize

      3.8MB

      MD5

      468dcdb06c6733d0048a75360d52e1a4

      SHA1

      eb1ad2cb3ddb7ac6560cf30cc7c286bd31989b1d

      SHA256

      803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457

      SHA512

      b78b6e303b4264727e157e559fcb947c7016087e453d4449001a5378297fc6306cec59aabec418f4a08e32101d7e74eca689a8801de451dbb76c5e696f4b0909

      Download Submit

    • memory/864-7-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/864-15-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/864-9-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/864-8-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-19-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-17-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-18-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-20-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-21-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-23-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-24-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/2620-27-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/3364-5-0x0000000002DA0000-0x0000000003491000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3364-4-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/3364-3-0x0000000000400000-0x0000000000B0B000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/3364-2-0x0000000002DA0000-0x0000000003491000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3364-1-0x00000000029F0000-0x0000000002D9E000-memory.dmp

      Filesize

      3.7MB

      Download