Analysis
-
max time kernel
2s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
17-05-2024 23:50
General
-
Target
b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec.exe
-
Size
4.1MB
-
MD5
9d4896bddbae7bc69e3eefbbf2ce1c86
-
SHA1
67b500f2923c0f4cbb0f8062bffc293a404e51b6
-
SHA256
b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec
-
SHA512
da357c7aefb1b46233b9cea7257afd8777ef8e6e05a8d7f1edacbd73ccca37802350561a10038c384715fcce3e63f6b534205f7a25d347257126188686080b5a
-
SSDEEP
98304:BqqJgO7W9SnF2QTYg7Hzo9TU2Df9e/pZ+O7BTR2yKUN:BqqJgO7W9SnJ3gf8jHXKu
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 19 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec.exe"C:\Users\Admin\AppData\Local\Temp\b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec.exe"C:\Users\Admin\AppData\Local\Temp\b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
19KB
MD5792b635444efae7a72adceb3561b99dd
SHA156d81f4ba2a0799e936fa9453a4f2901d30fd023
SHA2565f905c2ef7a182aa12a66a42453f12bd22704d135f15ceaf9b7e0150fc1e8188
SHA512c79490b9e338f46acff0d0b3919d2e191602c8694f56f13bbf698c0ffe1618d856f0ef3239eb9180713610544769c23f254bbd49f7ac074f21aabd5154c524b8
-
Filesize
19KB
MD598cc547609dcebfdf20a79256d084ea5
SHA1fde650cfa7e3833a3ccbbb73edfe6cda348535a0
SHA25608a8c9d4f7136037d6c692f9a9fb18eca7d73a909f05ac26da2b449463e9f415
SHA5121e57ea56b6f39c22d41c7cabf6ce994d94641a1ef61343fa5f979ae1fe24732bbdfcf10f2c8129bb33f21b4d1f392980ac7fd514730b9132ce7543dd41d67751
-
Filesize
19KB
MD5d99c5754af82a7fc5082d706532bd239
SHA13dba74389d8c00afa562b4b02a3421c47850e6a9
SHA256a8c261c318e627c42929d2f439b11e60fa40cc64dbc2f63edf007ca30c5fccb3
SHA512a9a36dd347f15ff5b99ea04fc29b88d9a2402fbc98951b4ee347715e96e016bcdef7bdeb5c5fb52e9c6640027cb2ac616293f8520d005147c67504398a2822a4
-
Filesize
19KB
MD56da855f0ae23fc6b0b054018a12846cd
SHA1292dcc9acb18fd54e139cf72eac994a876a230e5
SHA25637059723f9544a5ef503ffa465995033bc0f1ee3fa37d6b37b80573b4220b48b
SHA512a773a531047a9aa49607af88857bf57efa46fd3df875a31f3852e4cde427a0262568da12b5d96603fd16e2d940deef265ff5211fac8a68a7ffd31cce732e9edd
-
Filesize
19KB
MD56d4171ae4a960f830a9d5d95307bb179
SHA1bdbd00c7458b63221ca7ac8f13075af74c3f588b
SHA256d44d024827eac2ee64ed78f0a20f7ee8cab607a8187ae3eb9c8d99c0e73b8316
SHA5124e9eb6a0ddc0141484e5a6cecd55ffab822f11dcab2090cf62dbc7e77a4994a4cbf9f56fd5dc2e7580e0ee3114c7e70efe8239200d91484644eae0de34047675
-
Filesize
4.1MB
MD59d4896bddbae7bc69e3eefbbf2ce1c86
SHA167b500f2923c0f4cbb0f8062bffc293a404e51b6
SHA256b4139c3a227d8454b613ba81d1febb49e16e3aaf82a6baa7a0f15ed036eb16ec
SHA512da357c7aefb1b46233b9cea7257afd8777ef8e6e05a8d7f1edacbd73ccca37802350561a10038c384715fcce3e63f6b534205f7a25d347257126188686080b5a
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
84KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
120KB
-
Filesize
208KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
39.0MB
-
Filesize
4.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB