Analysis
-
max time kernel
8s -
max time network
294s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
16/05/2024, 22:49
General
-
Target
2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe
-
Size
4.1MB
-
MD5
1157922d694e53092c8c05331878f8a1
-
SHA1
f63cbc1b6e261bd011352c0f64ec6238ec37c397
-
SHA256
2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
-
SHA512
35d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1
-
SSDEEP
98304:cFETef+mmkxaPY+QSMo7d4VmoteWoCPtlnvHUEaCydSs:cFGef+mhxag+rMGd4V3tmut57ts
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 34 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe"C:\Users\Admin\AppData\Local\Temp\2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe"C:\Users\Admin\AppData\Local\Temp\2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5eca46bf53ca234f3b6ea5b9ede0ab116
SHA1a0617be1d4c62b4bf1489e9b73b45af6c52a640c
SHA256612f7c79b602a59cb127487a67c4fa7fe8b62f7232beb3491ac5a50bd5cefa51
SHA5129a0db634ae52fb4ee22f6941b6d85f8ee8fa582d082450746c44ed40664790caad647bed27fbe631b6fd0098fba8082ef33d83df9f99ac7a62f612aab4dab119
-
Filesize
18KB
MD543aab291852c6342774aaa9c29acf9f5
SHA1452a03fdbd7fdfa03bf9b4bf9c778fb6390d8fba
SHA25653060117bbecbaa672772b7ecac6df904c732036196f88667c03292629cb2216
SHA512dc3b9f98e827f2cdfe3c2a0919e70482cab34663bbc966a1f03cc31f31c2cad0b999c07f064a95c141afe1fbd02c22df380c0f1f434615c093f324e6b6788af3
-
Filesize
18KB
MD5f90062e172378ae315854f03f890432e
SHA12d0af8ee083b491c1b4e7533a9e2a254cc6c486b
SHA25660100ca05c216f7683132b05a635dbeb5cc68b307dd4a5696a4ac27d7e6511ed
SHA512ca738fd9f8b6b0ea3263d8cdfc06ba18d5878ebe278a2bbd2844df4e4e46f77801238b635748ce925e729dc4fc453933510927f4304f8819ebb9ec9b6bf9a37b
-
Filesize
18KB
MD52f2e659d77b5e9be09d1355ec4da150c
SHA1a4ca435eda9a7773db257db8c92167dac52e0568
SHA2564081ae51d3dedfce5fe61cc4a01eb8f7c52d517291010c42c9549a25680303f8
SHA5126b7a0e21ee1d16c7f778b656ea38f79f7de9b52b3343bd4c4b1a01cac3c6dd4e9c9890719b1edfd0d7cc1fd8cbd5a63ba7580b1fb335c7f60829e8c3e56d4a27
-
Filesize
18KB
MD5a214d9b82caf8ecb2af33df426485cf8
SHA139a21f87992ce0d0d4fbfb34923550aa8207d6c5
SHA2560022b6f9093bdd5b0f3377ba8c74f75c01280712a48a11fe32957c4b04591761
SHA512753c162d7d634c3657b96b35e039373ea8258d96b65ed2f0df94c3e53bb92924c49cb9f44d6dee4aaffa3bd2d3319c07c6670105b952a95c4aaa3c6c3b22ce29
-
Filesize
4.1MB
MD51157922d694e53092c8c05331878f8a1
SHA1f63cbc1b6e261bd011352c0f64ec6238ec37c397
SHA2562546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
SHA51235d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
9.1MB
-
Filesize
39.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
39.0MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
112KB
-
Filesize
6.9MB
-
Filesize
240KB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
472KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
660KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
204KB
-
Filesize
592KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB