Analysis

  • max time kernel
    6s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-05-2024 18:08

General

  • Target

    62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe

  • Size

    4.1MB

  • MD5

    879254e27447aa757455bfe4811f6da3

  • SHA1

    ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c

  • SHA256

    62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7

  • SHA512

    7a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec

  • SSDEEP

    98304:QoKALZtLSnhBaG13jSGzI9y04m/Xf7c/d7YDSGfJg5NEka2Q+gF:QC1IraEjIw04m/Xfo4a5yka2Q+gF

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

Processes

  • C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe
    "C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"
    1⤵
      PID:4344
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4696
      • C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe
        "C:\Users\Admin\AppData\Local\Temp\62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7.exe"
        2⤵
          PID:220
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1804
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
              PID:1928
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:4716
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2808
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4136
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              3⤵
                PID:3784
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3548
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • Creates scheduled task(s)
                  PID:4284
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:2648
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3572
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4952
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    4⤵
                      PID:4060
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • Creates scheduled task(s)
                      PID:3728
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      4⤵
                        PID:2052
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          5⤵
                            PID:2936
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              6⤵
                              • Launches sc.exe
                              PID:4924
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                      PID:3716

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjhzw5jz.xod.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      d0c46cad6c0778401e21910bd6b56b70

                      SHA1

                      7be418951ea96326aca445b8dfe449b2bfa0dca6

                      SHA256

                      9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                      SHA512

                      057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      7f627398bafd69448a8f49567c174385

                      SHA1

                      7c284e5d1b234a1687f793781c2de92742c71cb3

                      SHA256

                      ab26d72c00f17f9bdd85be7edc699a2bdae67cf7fcb2236e55ed6d796dd59f68

                      SHA512

                      6080c9e3703f5c70b242ba6dcad1efe835c1414fda8f04c19dd01e4325fb7a9215f119c2711f4e0870419f65d1f70b717c9117721c508285217dcb3967f26b74

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      0818e53efdf7acbe91eae2f15474b8ef

                      SHA1

                      e8476dfae750a607bf9433e803ce87d0bd6c29bf

                      SHA256

                      81a9f0d87dc686cc771790f42c9138b07a7438aa496eef76cbee6a19477fddab

                      SHA512

                      d91e295c28066359b3c61f602fa94be207aaa3f32b458b89446c189b8124a3d56aebb4bf2e2ca5187ddffb60c47f004a452929143064aeeafc7b8c1ed24de390

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      fb8261fe9a13df309c9ec6c889811bf4

                      SHA1

                      25cdcd4b6c34343bbd0b603e9789219ea4dbb976

                      SHA256

                      bc0551904893c0ad0135fbec6fb180576424283ceb1d2ed01b41510199ff08ed

                      SHA512

                      6e5be8a887035dafa4022a276c952f42c181588d8b2f3a480340a39d5aa1b75a8364df9946966331fd3d14db5f0abe0034a374cc1034a60a676e148065d63618

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      3176fb158f83c0db428496a14cf86712

                      SHA1

                      e0a49d2dedf111ff1dff73c293f6b28d4e47ede6

                      SHA256

                      db4a5034b5628d550a37f538f6cd4a0eea89730eeaca751eb039dc4b2a556ccf

                      SHA512

                      99984d1ae83ca5826ad2114e72ea4a893e609a88a845a38f3bee2c9c3a8cca9393911d8f72cc19895845a67545866961cc773492b270c6c7a4af32b94d151cc0

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      c9e5200c310a0d65721b15ff2bf42162

                      SHA1

                      1460bac6040067278974a2b7b02c1c439e29dfcd

                      SHA256

                      39c89fbf3535b25fd7adea84d2a0e4f6ab4f9df8a698ba8f044eccecd46e424d

                      SHA512

                      44f37783d648034f7b1a123f649156bad26ae664674df5c659246d60755c7ab1c88a4aa0b3ee62e9b8e4a5a27214efc83c525d6552641dfc1d7e949eb4e49dac

                    • C:\Windows\rss\csrss.exe

                      Filesize

                      4.1MB

                      MD5

                      879254e27447aa757455bfe4811f6da3

                      SHA1

                      ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c

                      SHA256

                      62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7

                      SHA512

                      7a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec

                    • C:\Windows\windefender.exe

                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                    • memory/220-121-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/220-126-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/1804-74-0x0000000007830000-0x0000000007841000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-75-0x0000000007880000-0x0000000007895000-memory.dmp

                      Filesize

                      84KB

                    • memory/1804-73-0x0000000007510000-0x00000000075B4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1804-63-0x00000000702C0000-0x000000007030C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1804-64-0x0000000070460000-0x00000000707B7000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1804-62-0x0000000005DA0000-0x00000000060F7000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2052-213-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2052-208-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2808-86-0x0000000005670000-0x00000000059C7000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2808-91-0x0000000070510000-0x0000000070867000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2808-90-0x00000000702C0000-0x000000007030C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3548-139-0x00000000702C0000-0x000000007030C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3548-140-0x0000000070460000-0x00000000707B7000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3572-162-0x0000000070360000-0x00000000706B7000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3572-172-0x00000000075D0000-0x0000000007674000-memory.dmp

                      Filesize

                      656KB

                    • memory/3572-174-0x0000000005D30000-0x0000000005D45000-memory.dmp

                      Filesize

                      84KB

                    • memory/3572-161-0x00000000701E0000-0x000000007022C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3572-160-0x00000000063D0000-0x000000000641C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3572-173-0x0000000007940000-0x0000000007951000-memory.dmp

                      Filesize

                      68KB

                    • memory/3572-158-0x0000000005EC0000-0x0000000006217000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3716-211-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/3716-222-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/3716-216-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/3784-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-204-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-215-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-196-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-227-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/3784-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/4136-110-0x00000000702C0000-0x000000007030C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4136-111-0x0000000070440000-0x0000000070797000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4344-52-0x0000000000400000-0x0000000002B0B000-memory.dmp

                      Filesize

                      39.0MB

                    • memory/4344-78-0x0000000004E30000-0x000000000571B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/4344-1-0x0000000004A20000-0x0000000004E21000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/4344-53-0x0000000004A20000-0x0000000004E21000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/4344-129-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/4344-2-0x0000000004E30000-0x000000000571B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/4344-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/4696-38-0x0000000074050000-0x0000000074801000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4696-36-0x0000000006F20000-0x0000000006FC4000-memory.dmp

                      Filesize

                      656KB

                    • memory/4696-47-0x0000000007170000-0x0000000007178000-memory.dmp

                      Filesize

                      32KB

                    • memory/4696-46-0x0000000007150000-0x000000000716A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4696-45-0x0000000007100000-0x0000000007115000-memory.dmp

                      Filesize

                      84KB

                    • memory/4696-44-0x00000000070F0000-0x00000000070FE000-memory.dmp

                      Filesize

                      56KB

                    • memory/4696-43-0x00000000070A0000-0x00000000070B1000-memory.dmp

                      Filesize

                      68KB

                    • memory/4696-42-0x0000000007190000-0x0000000007226000-memory.dmp

                      Filesize

                      600KB

                    • memory/4696-41-0x0000000007080000-0x000000000708A000-memory.dmp

                      Filesize

                      40KB

                    • memory/4696-4-0x000000007405E000-0x000000007405F000-memory.dmp

                      Filesize

                      4KB

                    • memory/4696-39-0x0000000007680000-0x0000000007CFA000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/4696-5-0x0000000002290000-0x00000000022C6000-memory.dmp

                      Filesize

                      216KB

                    • memory/4696-7-0x0000000074050000-0x0000000074801000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4696-40-0x0000000007040000-0x000000000705A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4696-24-0x0000000006EC0000-0x0000000006EF4000-memory.dmp

                      Filesize

                      208KB

                    • memory/4696-50-0x0000000074050000-0x0000000074801000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4696-37-0x0000000074050000-0x0000000074801000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4696-35-0x0000000006F00000-0x0000000006F1E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4696-26-0x0000000070440000-0x0000000070797000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4696-25-0x00000000702C0000-0x000000007030C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4696-23-0x0000000005ED0000-0x0000000005F16000-memory.dmp

                      Filesize

                      280KB

                    • memory/4696-22-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4696-21-0x0000000005A80000-0x0000000005A9E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4696-19-0x0000000074050000-0x0000000074801000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4696-20-0x00000000055F0000-0x0000000005947000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4696-10-0x0000000005580000-0x00000000055E6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4696-9-0x0000000004E80000-0x0000000004EE6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4696-8-0x0000000004BE0000-0x0000000004C02000-memory.dmp

                      Filesize

                      136KB

                    • memory/4696-6-0x0000000004F50000-0x000000000557A000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/4952-187-0x0000000070410000-0x0000000070767000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4952-186-0x00000000701E0000-0x000000007022C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4952-184-0x00000000062B0000-0x0000000006607000-memory.dmp

                      Filesize

                      3.3MB