Analysis

  • max time kernel
    8s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-05-2024 18:09

General

  • Target

    2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe

  • Size

    4.1MB

  • MD5

    b6c9cc6de33e5069f6bf72c955908590

  • SHA1

    3b33c0d85a14936142109152ba28070c414071dd

  • SHA256

    2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872

  • SHA512

    4a63747f2b16769de4177cc508d7e765bc5f773e734c1beb6da6e4b189605d900e3667581a2d3169c95ff926c334780f5a730d11a3cbb5de8ba91b426b5948bf

  • SSDEEP

    98304:YoKALZtLSnhBaG13jSGzI9y04m/Xf7c/d7YDSGfJg5NEka2Q+gG:YC1IraEjIw04m/Xfo4a5yka2Q+gG

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 14 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe
    "C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2748
    • C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe
      "C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"
      2⤵
        PID:2640
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1008
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          3⤵
            PID:4084
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:2852
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2944
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2216
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            3⤵
              PID:1632
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4696
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:1004
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                4⤵
                  PID:1332
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3404
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2792
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  4⤵
                    PID:4516
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • Creates scheduled task(s)
                    PID:5080
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    4⤵
                      PID:4084
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        5⤵
                          PID:1612
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            6⤵
                            • Launches sc.exe
                            PID:3844
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                    PID:1344

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2t2wfv1d.dfi.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                    Filesize

                    281KB

                    MD5

                    d98e33b66343e7c96158444127a117f6

                    SHA1

                    bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                    SHA256

                    5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                    SHA512

                    705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                    Filesize

                    2KB

                    MD5

                    d0c46cad6c0778401e21910bd6b56b70

                    SHA1

                    7be418951ea96326aca445b8dfe449b2bfa0dca6

                    SHA256

                    9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                    SHA512

                    057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    1f9430e8cb00bd4f203e13f3948e2e2e

                    SHA1

                    0c01b6e81e1bb4873de3a74057efa5f091651945

                    SHA256

                    5a7a5f27ac607e1b937069de2b1382bbb60adc9c6a33df0d71fb643ed4f957b1

                    SHA512

                    ddd88bee55157714ca67ef853fd7517909c5e8b62693712fc93577d1ee43a6167dc95b7991650f2718e5a326a94cd8da1e1f6df7728c4a214b5b89d73f47eaba

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    4c274d76c73963a8b7e5f8d528d498fc

                    SHA1

                    c2d9d6716493b460d80b0c0cb44f27ba2347df72

                    SHA256

                    dc9a8898e69207f97ac710e5ca3f12684d9eaa871619a6ebbabdc2019291f385

                    SHA512

                    8efccf7cea8276d5cb72799d25e369e4843438899e1340ba72fef5486a1d4d93cd10b5b35b6749d4588186befe608913ce474ad698151b5dd26dd95b2723dd54

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    315faef7c5e7f1b4de00ebf7d9958f57

                    SHA1

                    872ba03c3ff25675632be3f1b882bc55c912ad8a

                    SHA256

                    4303a6a8d99984f15524a25b8596e8475e9bd5f013fa428603a2367ca55b013c

                    SHA512

                    115fb3e4018ca2662ff55fd501e1de5c8075aa36f3eaa5aeec8a00fec1406798ad590bd40f0c48219f3287ac8b4eac4eb0a23e7a94c96dd6a0a59da6fa26a989

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    d8051ff84c0f7dacf8a1d861234f935e

                    SHA1

                    35a5e562b3683e4fbd029d6efde818afd36fd0e1

                    SHA256

                    573edc1a3438c899c96469dddce47eb8d0830043c07f67ad890e49a03c2c5a4d

                    SHA512

                    6d4ae5185e48d5e5d01185809d4a65b3cbfc145c65e7bf4cb552df645e5d0fd5f35579f13b91b78ed19caed844c713616c20d1ac8e7ef1967f287a81a40d7707

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                    Filesize

                    19KB

                    MD5

                    cd991fc72bd598416c4abf145ccf5ca2

                    SHA1

                    417c5b069498063cc3eac1461ebb5cbc4c33ba95

                    SHA256

                    155e10397d41bf2c944bf26328b0336bfbf9f677e97f91d846b68593c60a178f

                    SHA512

                    2ad755db886933ff03f42cdeb957cbcf3d8fe6ce8c0271e946ed0a3f1f098dde1f51a86463faca198891e1c3cc4a475ff3696c364484b11e0eb551a1f5a685e9

                  • C:\Windows\rss\csrss.exe

                    Filesize

                    2.1MB

                    MD5

                    1a63d3644b8744cc427c73b4e3ba75ec

                    SHA1

                    6cd5e3d113067faffe6f85d072414a6d368b1ba6

                    SHA256

                    65c07d7dadd85a8358f2dde059e6e5c0b0159da04bf345fea9f47f4aeb323941

                    SHA512

                    466e62b67ad5c110c7bc720a56bd9ba0453864d775740b7955f294dd0521b0013612ac75c91b8784817b02be74eea3806275ed99685ba8950cfe007e4e743f60

                  • C:\Windows\rss\csrss.exe

                    Filesize

                    3.6MB

                    MD5

                    1969388dbacca767f429ef13ed09463a

                    SHA1

                    5c16463d8dea20fb5f80b4468d27183312162cd4

                    SHA256

                    29eccada0679b26c6dc9f4477685de1244882bbaccd5bf5cead8535e23e69bb1

                    SHA512

                    2178af10352f58a4a92e422d7e4b6c74e083efc2f92116bc3dbd391e486dd0634d432c83a46ed358b5109409708f9c9cfb0909453d97a74e477302df93929775

                  • C:\Windows\windefender.exe

                    Filesize

                    2.0MB

                    MD5

                    8e67f58837092385dcf01e8a2b4f5783

                    SHA1

                    012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                    SHA256

                    166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                    SHA512

                    40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                  • memory/1008-71-0x0000000007580000-0x0000000007595000-memory.dmp

                    Filesize

                    84KB

                  • memory/1008-70-0x0000000007530000-0x0000000007541000-memory.dmp

                    Filesize

                    68KB

                  • memory/1008-50-0x0000000005A50000-0x0000000005DA7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1008-59-0x0000000070460000-0x00000000704AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/1008-60-0x00000000706B0000-0x0000000070A07000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1008-69-0x0000000007220000-0x00000000072C4000-memory.dmp

                    Filesize

                    656KB

                  • memory/1344-210-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/1344-204-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/1344-216-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/1520-1-0x00000000048A0000-0x0000000004C9F000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/1520-2-0x0000000004CA0000-0x000000000558B000-memory.dmp

                    Filesize

                    8.9MB

                  • memory/1520-49-0x00000000048A0000-0x0000000004C9F000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/1520-85-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                  • memory/1520-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                  • memory/1520-48-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-190-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-209-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-212-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-215-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-227-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/1632-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/2216-106-0x0000000070460000-0x00000000704AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2216-107-0x00000000706B0000-0x0000000070A07000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2640-120-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/2640-84-0x0000000000400000-0x0000000002B0B000-memory.dmp

                    Filesize

                    39.0MB

                  • memory/2748-22-0x0000000006F40000-0x0000000006F74000-memory.dmp

                    Filesize

                    208KB

                  • memory/2748-37-0x0000000007110000-0x000000000711A000-memory.dmp

                    Filesize

                    40KB

                  • memory/2748-23-0x0000000070460000-0x00000000704AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2748-34-0x0000000006FA0000-0x0000000007044000-memory.dmp

                    Filesize

                    656KB

                  • memory/2748-21-0x00000000060D0000-0x0000000006116000-memory.dmp

                    Filesize

                    280KB

                  • memory/2748-20-0x0000000005B20000-0x0000000005B6C000-memory.dmp

                    Filesize

                    304KB

                  • memory/2748-33-0x0000000006F80000-0x0000000006F9E000-memory.dmp

                    Filesize

                    120KB

                  • memory/2748-19-0x0000000005B00000-0x0000000005B1E000-memory.dmp

                    Filesize

                    120KB

                  • memory/2748-43-0x0000000007200000-0x0000000007208000-memory.dmp

                    Filesize

                    32KB

                  • memory/2748-18-0x0000000005710000-0x0000000005A67000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2748-36-0x00000000070D0000-0x00000000070EA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2748-35-0x0000000007710000-0x0000000007D8A000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2748-8-0x0000000004E90000-0x0000000004EF6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2748-24-0x00000000705E0000-0x0000000070937000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2748-38-0x0000000007220000-0x00000000072B6000-memory.dmp

                    Filesize

                    600KB

                  • memory/2748-39-0x0000000007130000-0x0000000007141000-memory.dmp

                    Filesize

                    68KB

                  • memory/2748-9-0x00000000055E0000-0x0000000005646000-memory.dmp

                    Filesize

                    408KB

                  • memory/2748-40-0x0000000007180000-0x000000000718E000-memory.dmp

                    Filesize

                    56KB

                  • memory/2748-41-0x0000000007190000-0x00000000071A5000-memory.dmp

                    Filesize

                    84KB

                  • memory/2748-7-0x0000000004C70000-0x0000000004C92000-memory.dmp

                    Filesize

                    136KB

                  • memory/2748-46-0x00000000003F0000-0x0000000000459000-memory.dmp

                    Filesize

                    420KB

                  • memory/2748-4-0x00000000003F0000-0x0000000000459000-memory.dmp

                    Filesize

                    420KB

                  • memory/2748-42-0x00000000071E0000-0x00000000071FA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2748-6-0x0000000004F00000-0x000000000552A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/2748-5-0x0000000002640000-0x0000000002676000-memory.dmp

                    Filesize

                    216KB

                  • memory/2792-180-0x0000000070380000-0x00000000703CC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2792-181-0x0000000070500000-0x0000000070857000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2944-86-0x0000000070460000-0x00000000704AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2944-87-0x00000000706B0000-0x0000000070A07000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/3404-157-0x0000000070380000-0x00000000703CC000-memory.dmp

                    Filesize

                    304KB

                  • memory/3404-169-0x00000000062A0000-0x00000000062B5000-memory.dmp

                    Filesize

                    84KB

                  • memory/3404-168-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

                    Filesize

                    68KB

                  • memory/3404-158-0x0000000070500000-0x0000000070857000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/3404-167-0x0000000007A60000-0x0000000007B04000-memory.dmp

                    Filesize

                    656KB

                  • memory/3404-156-0x0000000006D30000-0x0000000006D7C000-memory.dmp

                    Filesize

                    304KB

                  • memory/3404-153-0x00000000063C0000-0x0000000006717000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/4084-207-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/4084-202-0x0000000000400000-0x00000000008DF000-memory.dmp

                    Filesize

                    4.9MB

                  • memory/4696-134-0x0000000070460000-0x00000000704AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/4696-135-0x0000000070600000-0x0000000070957000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/4696-132-0x0000000005C40000-0x0000000005F97000-memory.dmp

                    Filesize

                    3.3MB