Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73c0e967b3fc7caef61bb93b86d3647a8b6d4f6c584dc6230e43d0e1ee5eb24b

  • Size

    4.1MB

  • Sample

    240516-e2ljvabh6v

  • MD5

    d142e671eded49f4bf539b2b1218b313

  • SHA1

    78661927b47b3a4eb0c091eb325a69b2727c1360

  • SHA256

    73c0e967b3fc7caef61bb93b86d3647a8b6d4f6c584dc6230e43d0e1ee5eb24b

  • SHA512

    5a7ad1249fa322ce05a6528f927f424e33d649d0e2cf5f0127eacd6cf02aa420f76ff848469674678cbf1ed220d2155cea580e24acd7c0d31587856f10a21a7e

  • SSDEEP

    98304:Z96GAmuNBigEkoqfZTwC6uGlBZNljS4jcw:ZI9hoq9wC6uGlB/xgw

Score
10/10
gluptebadiscoverydropperevasionexecutionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      73c0e967b3fc7caef61bb93b86d3647a8b6d4f6c584dc6230e43d0e1ee5eb24b

    • Size

      4.1MB

    • MD5

      d142e671eded49f4bf539b2b1218b313

    • SHA1

      78661927b47b3a4eb0c091eb325a69b2727c1360

    • SHA256

      73c0e967b3fc7caef61bb93b86d3647a8b6d4f6c584dc6230e43d0e1ee5eb24b

    • SHA512

      5a7ad1249fa322ce05a6528f927f424e33d649d0e2cf5f0127eacd6cf02aa420f76ff848469674678cbf1ed220d2155cea580e24acd7c0d31587856f10a21a7e

    • SSDEEP

      98304:Z96GAmuNBigEkoqfZTwC6uGlBZNljS4jcw:ZI9hoq9wC6uGlB/xgw

    Score
    10/10
    gluptebadiscoverydropperevasionexecutionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Blocklisted process makes network request

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks