Malware Analysis Report

2024-11-13 19:43

Sample ID 240517-lvf44scg98
Target 737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0
SHA256 737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0
Tags
glupteba dropper evasion execution loader upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0

Threat Level: Known bad

The file 737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0 was found to be: Known bad.

Malicious Activity Summary

glupteba dropper evasion execution loader upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 09:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 09:51

Reported

2024-05-17 09:53

Platform

win10v2004-20240426-en

Max time kernel

21s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 872 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\system32\cmd.exe
PID 1928 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\system32\cmd.exe
PID 4704 wrote to memory of 3252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4704 wrote to memory of 3252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1928 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1928 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.128:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 128.61.62.23.in-addr.arpa udp
NL 23.62.61.128:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 05514e1c-aac4-49a4-9973-bcc4ea4bea96.uuid.myfastupdate.org udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server6.myfastupdate.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 15.197.250.192:3478 stun.sipgate.net udp
BG 185.82.216.111:443 server6.myfastupdate.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 192.250.197.15.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.111:443 server6.myfastupdate.org tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
IE 52.111.236.23:443 tcp
BG 185.82.216.111:443 server6.myfastupdate.org tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/872-1-0x00000000047F0000-0x0000000004BF6000-memory.dmp

memory/872-2-0x0000000004C00000-0x00000000054EB000-memory.dmp

memory/872-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1976-4-0x000000007408E000-0x000000007408F000-memory.dmp

memory/1976-5-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

memory/1976-7-0x0000000074080000-0x0000000074830000-memory.dmp

memory/1976-6-0x0000000005670000-0x0000000005C98000-memory.dmp

memory/1976-8-0x0000000074080000-0x0000000074830000-memory.dmp

memory/1976-9-0x00000000054E0000-0x0000000005502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bjbnqrld.krn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1976-11-0x0000000005D80000-0x0000000005DE6000-memory.dmp

memory/1976-10-0x0000000005D10000-0x0000000005D76000-memory.dmp

memory/1976-21-0x0000000005DF0000-0x0000000006144000-memory.dmp

memory/1976-22-0x00000000063A0000-0x00000000063BE000-memory.dmp

memory/1976-23-0x00000000063F0000-0x000000000643C000-memory.dmp

memory/1976-24-0x0000000006910000-0x0000000006954000-memory.dmp

memory/1976-25-0x00000000076C0000-0x0000000007736000-memory.dmp

memory/1976-27-0x0000000007760000-0x000000000777A000-memory.dmp

memory/1976-26-0x0000000007DC0000-0x000000000843A000-memory.dmp

memory/1976-30-0x00000000700A0000-0x00000000703F4000-memory.dmp

memory/1976-40-0x0000000007960000-0x000000000797E000-memory.dmp

memory/1976-29-0x000000006FF20000-0x000000006FF6C000-memory.dmp

memory/1976-43-0x0000000007A70000-0x0000000007A7A000-memory.dmp

memory/1976-44-0x0000000074080000-0x0000000074830000-memory.dmp

memory/1976-42-0x0000000074080000-0x0000000074830000-memory.dmp

memory/1976-41-0x0000000007980000-0x0000000007A23000-memory.dmp

memory/1976-28-0x0000000007920000-0x0000000007952000-memory.dmp

memory/1976-47-0x0000000007A80000-0x0000000007A91000-memory.dmp

memory/1976-46-0x0000000007B80000-0x0000000007C16000-memory.dmp

memory/872-45-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1976-49-0x0000000007AE0000-0x0000000007AF4000-memory.dmp

memory/1976-48-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

memory/1976-51-0x0000000007B20000-0x0000000007B28000-memory.dmp

memory/1976-50-0x0000000007B30000-0x0000000007B4A000-memory.dmp

memory/1976-54-0x0000000074080000-0x0000000074830000-memory.dmp

memory/212-61-0x0000000005760000-0x0000000005AB4000-memory.dmp

memory/872-66-0x0000000004C00000-0x00000000054EB000-memory.dmp

memory/212-78-0x0000000006F70000-0x0000000007013000-memory.dmp

memory/212-68-0x00000000706A0000-0x00000000709F4000-memory.dmp

memory/212-67-0x000000006FF20000-0x000000006FF6C000-memory.dmp

memory/212-79-0x00000000072A0000-0x00000000072B1000-memory.dmp

memory/212-80-0x00000000072F0000-0x0000000007304000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f9c2bdc20f901264d98521fa8dcf6efc
SHA1 9100188f5216ab966b618ac41e1ba9b61da17648
SHA256 a3a5638d96fb9aa643a00bd2dc0b4b3f651ae1781b2324077c4c99873428af20
SHA512 52f7f7739e7b18b3a5817808e63b27625aa3a2fb09177ccbf7b634b7a6fe49d814fae78387a8a2d23da86639c25346b9c2330c477a01be4d31b911fe34584f7f

memory/4052-93-0x00000000057D0000-0x0000000005B24000-memory.dmp

memory/872-95-0x00000000047F0000-0x0000000004BF6000-memory.dmp

memory/4052-96-0x000000006FF20000-0x000000006FF6C000-memory.dmp

memory/4052-97-0x0000000070310000-0x0000000070664000-memory.dmp

memory/4744-117-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9ceee1ebd292adc5f54b6e12298777ef
SHA1 2747ba9565316a44c5d988169fab01d75a2266f6
SHA256 84d9c9fd4a6287f92fa68b05bbf8e204504e509b908349b1350d046a64e6f6f5
SHA512 4d7626f8fde830efc9126ab2ea227a03a4cc8b647d2caef92f3f13e526c665c2ff08dcd4a8fabb149590f0715dc44c4d80d09d8c1f626b360b3c0253fcd23c4d

memory/4744-120-0x00000000700C0000-0x0000000070414000-memory.dmp

memory/4744-119-0x000000006FF20000-0x000000006FF6C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c36c383b7c637e9b5a636103876cff5e
SHA1 3a5e514a6bb20d5627455b49114e44e4e5598e46
SHA256 737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0
SHA512 9389b741d6f6b964a7849d5c5393df993b7917a2cc8b19b45eb8c41eb4a2b286e89083711e6661f7dcb086a0ee733bf8fd8edee45615add00e80e05449a30dc0

memory/872-136-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1928-137-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/872-138-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d3761bf2fbdcbd38b5d050211e2d4523
SHA1 1af0c8af4da1a82a407c08556776edc577414dc8
SHA256 c4560c2fd0189f091aa4d5a2fa1ec3f5fe83402f12974130c6c8e4c5cf416416
SHA512 28e4bcec413e120a2ee97ea0d1c6a8c1bd32d4bf4bb47729771cf05b248bbba1e62edb6ccdee4f2d66bcc73952781a3a3cbe9bb93cebcebaac013f2b832f104a

memory/3480-149-0x000000006FF20000-0x000000006FF6C000-memory.dmp

memory/3480-150-0x00000000700A0000-0x00000000703F4000-memory.dmp

memory/4544-170-0x0000000005900000-0x0000000005C54000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 535824519214f7fb8d740934e45860fe
SHA1 f54e31af27b928e24be3518a8d177971635fb3fc
SHA256 b50afe397b032cceee558bdf5c3a798a51909cdeb9ad7987582ac0727421f047
SHA512 602c27b6e6b77e2aa2ea8ffc3dec083965432e2cfa3be457ff29544a2b67d54eb61f1b1ce79b3615b090fd507e1ff8f79add18f2a45087cd9c7a10724b541671

memory/4544-172-0x0000000005FF0000-0x000000000603C000-memory.dmp

memory/4544-174-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/4544-175-0x00000000705D0000-0x0000000070924000-memory.dmp

memory/4544-185-0x00000000071C0000-0x0000000007263000-memory.dmp

memory/4544-186-0x00000000074C0000-0x00000000074D1000-memory.dmp

memory/4544-187-0x0000000005800000-0x0000000005814000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 813576e74d7cbe71e797de97b4c68870
SHA1 8ef36ff44dc9db731233cef4b560cb3d06668394
SHA256 10af699aaedc73f135633069fb6e867eebf2610fd2c3c35af4f1b875531d58ee
SHA512 d5b935b07bf9d4709025d0cbe14c4d3a0fbb6954fb09ba232e97db42db1593b464f1a5c1a88d38cb7b4ded1751f8bf35ca444fd7ccebd86430b61ab0b59e4d73

memory/5108-200-0x00000000705D0000-0x0000000070924000-memory.dmp

memory/5108-199-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/1300-212-0x0000000000400000-0x0000000002B0D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2820-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/448-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2820-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1300-229-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/448-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1300-232-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-236-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/448-241-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1300-240-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-244-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-249-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-252-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-256-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-260-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-264-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1300-269-0x0000000000400000-0x0000000002B0D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 09:51

Reported

2024-05-17 09:53

Platform

win11-20240426-en

Max time kernel

6s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe

"C:\Users\Admin\AppData\Local\Temp\737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 5aefd627-dd4e-409b-b841-244bdbedc5ab.uuid.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server10.myfastupdate.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server10.myfastupdate.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.111:443 server10.myfastupdate.org tcp
US 74.125.250.129:19302 stun3.l.google.com udp
IE 52.111.236.22:443 tcp
BG 185.82.216.111:443 server10.myfastupdate.org tcp

Files

memory/1576-1-0x0000000004990000-0x0000000004D96000-memory.dmp

memory/1576-2-0x0000000004DA0000-0x000000000568B000-memory.dmp

memory/1576-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3508-4-0x000000007424E000-0x000000007424F000-memory.dmp

memory/3508-5-0x00000000047A0000-0x00000000047D6000-memory.dmp

memory/3508-7-0x0000000004EF0000-0x000000000551A000-memory.dmp

memory/3508-6-0x0000000074240000-0x00000000749F1000-memory.dmp

memory/3508-8-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

memory/3508-11-0x0000000005700000-0x0000000005766000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g0gpietg.b1o.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3508-20-0x00000000057D0000-0x0000000005B27000-memory.dmp

memory/3508-10-0x0000000074240000-0x00000000749F1000-memory.dmp

memory/3508-9-0x0000000005690000-0x00000000056F6000-memory.dmp

memory/3508-21-0x0000000005C50000-0x0000000005C6E000-memory.dmp

memory/3508-22-0x0000000005C70000-0x0000000005CBC000-memory.dmp

memory/3508-23-0x0000000006050000-0x0000000006096000-memory.dmp

memory/3508-37-0x0000000074240000-0x00000000749F1000-memory.dmp

memory/3508-36-0x00000000070C0000-0x0000000007164000-memory.dmp

memory/3508-35-0x00000000070A0000-0x00000000070BE000-memory.dmp

memory/3508-40-0x00000000071F0000-0x000000000720A000-memory.dmp

memory/3508-39-0x0000000007830000-0x0000000007EAA000-memory.dmp

memory/3508-38-0x0000000074240000-0x00000000749F1000-memory.dmp

memory/3508-41-0x0000000007230000-0x000000000723A000-memory.dmp

memory/3508-26-0x0000000070630000-0x0000000070987000-memory.dmp

memory/3508-25-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/3508-42-0x00000000072F0000-0x0000000007386000-memory.dmp

memory/3508-43-0x0000000007260000-0x0000000007271000-memory.dmp

memory/3508-24-0x0000000007060000-0x0000000007094000-memory.dmp

memory/3508-44-0x00000000072A0000-0x00000000072AE000-memory.dmp

memory/3508-45-0x00000000072B0000-0x00000000072C5000-memory.dmp

memory/3508-46-0x00000000073B0000-0x00000000073CA000-memory.dmp

memory/3508-47-0x0000000007390000-0x0000000007398000-memory.dmp

memory/3508-50-0x0000000074240000-0x00000000749F1000-memory.dmp

memory/1576-52-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/1576-53-0x0000000004990000-0x0000000004D96000-memory.dmp

memory/1576-54-0x0000000004DA0000-0x000000000568B000-memory.dmp

memory/4536-63-0x0000000005C70000-0x0000000005FC7000-memory.dmp

memory/4536-74-0x00000000073C0000-0x0000000007464000-memory.dmp

memory/4536-65-0x00000000706C0000-0x0000000070A17000-memory.dmp

memory/4536-64-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/4536-75-0x00000000076F0000-0x0000000007701000-memory.dmp

memory/4536-76-0x0000000007740000-0x0000000007755000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9905ca290e9f276a5248cf1b3fdad543
SHA1 6de464230705173c1aeabf43eb8113c17fbf036b
SHA256 f4507abcb78a42d9113f4584f4a13a927fe428ccd1d5fb3104a42fba2c56bfd2
SHA512 a4092123dcc3b7b893e8c858405a597ae29eaafd10fdc18cfa5a224242c9f517866db0b6b867fcdcfdf376132cae267b26bbe669d079b977a2b347368ad239e2

memory/1688-90-0x0000000070630000-0x0000000070987000-memory.dmp

memory/1688-89-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/3456-108-0x00000000061E0000-0x0000000006537000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 166a05b6fc2229b4589402744f1de4ec
SHA1 7232452098e65f32fa8d6b9a2f5d78ba66196ee1
SHA256 4c397c97f1181a4920c1a1b99de54bc4b21b741e23bab453ee38e6f4c9dd3c99
SHA512 eb86f9301adfed66884823381f609c46dc7132ad932d4cd6f4386bb6951a10642f53f11f9bdc705c6388eac099d7d7b73c13ca2ecd25af71205837418d78d5c8

memory/3456-111-0x00000000706E0000-0x0000000070A37000-memory.dmp

memory/3456-110-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/1576-122-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c36c383b7c637e9b5a636103876cff5e
SHA1 3a5e514a6bb20d5627455b49114e44e4e5598e46
SHA256 737ebbb261e2ef22e4b23cfc572bbe444693b4467e773fc6f7777dd6f9a68fa0
SHA512 9389b741d6f6b964a7849d5c5393df993b7917a2cc8b19b45eb8c41eb4a2b286e89083711e6661f7dcb086a0ee733bf8fd8edee45615add00e80e05449a30dc0

memory/1180-121-0x0000000000400000-0x0000000002B0D000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7083d126756b99495284bfa9019f6f4e
SHA1 c7d2700931a12077d906efd21c5a1f505d2b3900
SHA256 b438b7c551ca23c157cd7bb890bc115e4ace748f07b859ba2ae1e74f7a69cff9
SHA512 77952996b96ea90396663036bc7d30af3e251017b337ab2ca2d7635eea7da294f56e0bbf2791b23698e445c94792e31fe62d67b8b489ab5d2a7ce949c1db2345

memory/2512-139-0x00000000706E0000-0x0000000070A37000-memory.dmp

memory/2512-138-0x00000000704B0000-0x00000000704FC000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4def429dc7c073cdc08503ae717f7328
SHA1 61e41f2bdcf073b6c2007bc36985522ca4721eff
SHA256 b2c91494d6c668735553fd717f956750bf6c9f6d54a7d84d4713705f336eb11d
SHA512 7f25bbcb2a80f8a8087c26317d5bfee1cea515757264f3d48ac1bb724c13f9c7ba50483959f4fb5ab052a1c2ec7517da46995908ec8207eaa3d2980d69339ea5

memory/1272-157-0x0000000005E80000-0x00000000061D7000-memory.dmp

memory/1272-159-0x0000000006800000-0x000000000684C000-memory.dmp

memory/1272-161-0x0000000070550000-0x00000000708A7000-memory.dmp

memory/1272-170-0x0000000007540000-0x00000000075E4000-memory.dmp

memory/1272-160-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/1272-171-0x0000000007840000-0x0000000007851000-memory.dmp

memory/1272-172-0x0000000005C40000-0x0000000005C55000-memory.dmp

memory/2460-182-0x0000000006130000-0x0000000006487000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 55127556e9f15703e2a4076c2e3ad6b4
SHA1 9182c225fc9bf085068206a80df3c829f3af0ab9
SHA256 f70b45e7d92b7fcf89f9a2c8865d3bc3495af437efb459b590596e887d0db102
SHA512 3ac2cb707c32d39a3ea582a6ebcf4f18ce0328008757c985e8405a3466c4e6993c98043f3245f76729bfa39b04dfb3f7544f99d4a08d0023b5187a94318cccd3

memory/2460-184-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/2460-185-0x00000000705E0000-0x0000000070937000-memory.dmp

memory/1180-195-0x0000000000400000-0x0000000002B0D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4740-202-0x0000000000400000-0x0000000002B0D000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1480-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4180-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1480-213-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4740-214-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4180-218-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4740-217-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-221-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4180-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4740-225-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-229-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-234-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-237-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-241-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-245-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-249-0x0000000000400000-0x0000000002B0D000-memory.dmp

memory/4740-253-0x0000000000400000-0x0000000002B0D000-memory.dmp