Analysis
-
max time kernel
6s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-05-2024 18:08
Static task
static1
Behavioral task
behavioral1
Sample
62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe
Resource
win10v2004-20240426-en
General
-
Target
62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe
-
Size
4.1MB
-
MD5
879254e27447aa757455bfe4811f6da3
-
SHA1
ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c
-
SHA256
62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7
-
SHA512
7a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec
-
SSDEEP
98304:QoKALZtLSnhBaG13jSGzI9y04m/Xf7c/d7YDSGfJg5NEka2Q+gF:QC1IraEjIw04m/Xfo4a5yka2Q+gF
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral2/memory/4344-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4344-2-0x0000000004E30000-0x000000000571B000-memory.dmp family_glupteba behavioral2/memory/4344-52-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/4344-78-0x0000000004E30000-0x000000000571B000-memory.dmp family_glupteba behavioral2/memory/220-121-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/220-126-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/4344-129-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3784-196-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-204-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-215-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-218-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-221-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-224-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-227-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-230-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-233-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-236-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-239-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/3784-242-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4716 netsh.exe -
resource yara_rule behavioral2/files/0x000200000002a9ed-207.dat upx behavioral2/memory/2052-208-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3716-211-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2052-213-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3716-216-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3716-222-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4924 sc.exe -
pid Process 1804 powershell.exe 2808 powershell.exe 4136 powershell.exe 3548 powershell.exe 3572 powershell.exe 4952 powershell.exe 4696 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4284 schtasks.exe 3728 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"1⤵PID:4344
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
PID:4696
-
-
C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"2⤵PID:220
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:1928
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4716
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:2808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:4136
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:3784
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:3548
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4284
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2648
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:3572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:4060
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3728
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:2052
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2936
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:4924
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:3716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57f627398bafd69448a8f49567c174385
SHA17c284e5d1b234a1687f793781c2de92742c71cb3
SHA256ab26d72c00f17f9bdd85be7edc699a2bdae67cf7fcb2236e55ed6d796dd59f68
SHA5126080c9e3703f5c70b242ba6dcad1efe835c1414fda8f04c19dd01e4325fb7a9215f119c2711f4e0870419f65d1f70b717c9117721c508285217dcb3967f26b74
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50818e53efdf7acbe91eae2f15474b8ef
SHA1e8476dfae750a607bf9433e803ce87d0bd6c29bf
SHA25681a9f0d87dc686cc771790f42c9138b07a7438aa496eef76cbee6a19477fddab
SHA512d91e295c28066359b3c61f602fa94be207aaa3f32b458b89446c189b8124a3d56aebb4bf2e2ca5187ddffb60c47f004a452929143064aeeafc7b8c1ed24de390
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fb8261fe9a13df309c9ec6c889811bf4
SHA125cdcd4b6c34343bbd0b603e9789219ea4dbb976
SHA256bc0551904893c0ad0135fbec6fb180576424283ceb1d2ed01b41510199ff08ed
SHA5126e5be8a887035dafa4022a276c952f42c181588d8b2f3a480340a39d5aa1b75a8364df9946966331fd3d14db5f0abe0034a374cc1034a60a676e148065d63618
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53176fb158f83c0db428496a14cf86712
SHA1e0a49d2dedf111ff1dff73c293f6b28d4e47ede6
SHA256db4a5034b5628d550a37f538f6cd4a0eea89730eeaca751eb039dc4b2a556ccf
SHA51299984d1ae83ca5826ad2114e72ea4a893e609a88a845a38f3bee2c9c3a8cca9393911d8f72cc19895845a67545866961cc773492b270c6c7a4af32b94d151cc0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c9e5200c310a0d65721b15ff2bf42162
SHA11460bac6040067278974a2b7b02c1c439e29dfcd
SHA25639c89fbf3535b25fd7adea84d2a0e4f6ab4f9df8a698ba8f044eccecd46e424d
SHA51244f37783d648034f7b1a123f649156bad26ae664674df5c659246d60755c7ab1c88a4aa0b3ee62e9b8e4a5a27214efc83c525d6552641dfc1d7e949eb4e49dac
-
Filesize
4.1MB
MD5879254e27447aa757455bfe4811f6da3
SHA1ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c
SHA25662d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7
SHA5127a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec