Analysis
-
max time kernel
8s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-05-2024 18:09
Static task
static1
Behavioral task
behavioral1
Sample
2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe
Resource
win10v2004-20240426-en
General
-
Target
2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe
-
Size
4.1MB
-
MD5
b6c9cc6de33e5069f6bf72c955908590
-
SHA1
3b33c0d85a14936142109152ba28070c414071dd
-
SHA256
2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872
-
SHA512
4a63747f2b16769de4177cc508d7e765bc5f773e734c1beb6da6e4b189605d900e3667581a2d3169c95ff926c334780f5a730d11a3cbb5de8ba91b426b5948bf
-
SSDEEP
98304:YoKALZtLSnhBaG13jSGzI9y04m/Xf7c/d7YDSGfJg5NEka2Q+gG:YC1IraEjIw04m/Xfo4a5yka2Q+gG
Malware Config
Signatures
-
Glupteba payload 14 IoCs
resource yara_rule behavioral2/memory/1520-2-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral2/memory/1520-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1520-48-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-205-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-209-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-212-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-215-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-218-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-221-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-224-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-227-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-230-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-233-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba behavioral2/memory/1632-236-0x0000000000400000-0x0000000002B0B000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2852 netsh.exe -
resource yara_rule behavioral2/memory/4084-202-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000200000002aa0f-203.dat upx behavioral2/memory/4084-207-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1344-204-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1344-210-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1344-216-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3844 sc.exe -
pid Process 1008 powershell.exe 2944 powershell.exe 2216 powershell.exe 4696 powershell.exe 3404 powershell.exe 2792 powershell.exe 2748 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1004 schtasks.exe 5080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2748 powershell.exe 2748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2748 1520 2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe 83 PID 1520 wrote to memory of 2748 1520 2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe 83 PID 1520 wrote to memory of 2748 1520 2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"C:\Users\Admin\AppData\Local\Temp\2860b6d7bb3bce8421616938ce96c83c40408c3b0d4e3d3da61757367ecb0872.exe"2⤵PID:2640
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:1008
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:4084
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2852
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:2944
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:2216
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:1632
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:4696
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1004
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1332
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:3404
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:4516
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:5080
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4084
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:1612
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:3844
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:1344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51f9430e8cb00bd4f203e13f3948e2e2e
SHA10c01b6e81e1bb4873de3a74057efa5f091651945
SHA2565a7a5f27ac607e1b937069de2b1382bbb60adc9c6a33df0d71fb643ed4f957b1
SHA512ddd88bee55157714ca67ef853fd7517909c5e8b62693712fc93577d1ee43a6167dc95b7991650f2718e5a326a94cd8da1e1f6df7728c4a214b5b89d73f47eaba
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54c274d76c73963a8b7e5f8d528d498fc
SHA1c2d9d6716493b460d80b0c0cb44f27ba2347df72
SHA256dc9a8898e69207f97ac710e5ca3f12684d9eaa871619a6ebbabdc2019291f385
SHA5128efccf7cea8276d5cb72799d25e369e4843438899e1340ba72fef5486a1d4d93cd10b5b35b6749d4588186befe608913ce474ad698151b5dd26dd95b2723dd54
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5315faef7c5e7f1b4de00ebf7d9958f57
SHA1872ba03c3ff25675632be3f1b882bc55c912ad8a
SHA2564303a6a8d99984f15524a25b8596e8475e9bd5f013fa428603a2367ca55b013c
SHA512115fb3e4018ca2662ff55fd501e1de5c8075aa36f3eaa5aeec8a00fec1406798ad590bd40f0c48219f3287ac8b4eac4eb0a23e7a94c96dd6a0a59da6fa26a989
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d8051ff84c0f7dacf8a1d861234f935e
SHA135a5e562b3683e4fbd029d6efde818afd36fd0e1
SHA256573edc1a3438c899c96469dddce47eb8d0830043c07f67ad890e49a03c2c5a4d
SHA5126d4ae5185e48d5e5d01185809d4a65b3cbfc145c65e7bf4cb552df645e5d0fd5f35579f13b91b78ed19caed844c713616c20d1ac8e7ef1967f287a81a40d7707
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cd991fc72bd598416c4abf145ccf5ca2
SHA1417c5b069498063cc3eac1461ebb5cbc4c33ba95
SHA256155e10397d41bf2c944bf26328b0336bfbf9f677e97f91d846b68593c60a178f
SHA5122ad755db886933ff03f42cdeb957cbcf3d8fe6ce8c0271e946ed0a3f1f098dde1f51a86463faca198891e1c3cc4a475ff3696c364484b11e0eb551a1f5a685e9
-
Filesize
2.1MB
MD51a63d3644b8744cc427c73b4e3ba75ec
SHA16cd5e3d113067faffe6f85d072414a6d368b1ba6
SHA25665c07d7dadd85a8358f2dde059e6e5c0b0159da04bf345fea9f47f4aeb323941
SHA512466e62b67ad5c110c7bc720a56bd9ba0453864d775740b7955f294dd0521b0013612ac75c91b8784817b02be74eea3806275ed99685ba8950cfe007e4e743f60
-
Filesize
3.6MB
MD51969388dbacca767f429ef13ed09463a
SHA15c16463d8dea20fb5f80b4468d27183312162cd4
SHA25629eccada0679b26c6dc9f4477685de1244882bbaccd5bf5cead8535e23e69bb1
SHA5122178af10352f58a4a92e422d7e4b6c74e083efc2f92116bc3dbd391e486dd0634d432c83a46ed358b5109409708f9c9cfb0909453d97a74e477302df93929775
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec