Analysis
-
max time kernel
0s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
18-05-2024 21:47
General
-
Target
9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64.exe
-
Size
4.1MB
-
MD5
537aa0f899ac790aba441a3f63a659d2
-
SHA1
bc2b72c13d96e3da00efde6818121e69895ff60b
-
SHA256
9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64
-
SHA512
3753655a90b5836fd8f3e3f410fb9689f8396078384511d795ee9b6db88d06794775650ba172de3b24adbbfceff616fef4dafdfc44eb7c81abb8c10fd652f829
-
SSDEEP
98304:BsVQ+hudF4keJeyEqK0evsENr9r54Wa5Cc1nHXivv:Bs5hioeyE6OsERj43nE
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 14 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64.exe"C:\Users\Admin\AppData\Local\Temp\9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64.exe"C:\Users\Admin\AppData\Local\Temp\9a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
19KB
MD5f964a0d3b64f4f9731352b7ed4d4ba9b
SHA1dd906055994b4d24c25a52ec373121a1886915e2
SHA256790a23036bfaccdb71eec1c479aa5a6b62a408a72aaf633f76e5c711dad824c9
SHA512ecfeb39ef30dd9f1042d8ec155d59e6634cadf9b237d381a0e7e54bfcc05b082696895e2840cbef9f714965060f3a3d20e2536f41b17819caf7e905ff6da39dd
-
Filesize
19KB
MD5e7fd606831247db4c73ec375b8206259
SHA1d627306bb75a28fc191d04cf35f656a771bad7a9
SHA256806cbdb393905f29d4b1d01ef135b307757f2623d65680331f9d47ea63227483
SHA512a0403287a198a5161a408ee153757664ddfe32301021dec36b7169b0ef5961b00969ffa8d600a7c037deffbc248f494eee2695fa9422dd1606cb97e97f76ebfb
-
Filesize
19KB
MD5420e70de501cadcfd4ae3fc60e9fa525
SHA155400239729b68873f4d9c17d37b23033902e5f5
SHA256bbf200f88fcac36bef1ead685766eb670dbbb64d534f3e3c30aa31f11e53e852
SHA5121b3dd4375c6078cd32f5b4f5ad72d90a45785637d1cb5e948e5b43e1952059c2b9f0dab901b63502ff07481682ff7fcac55e32a07675d5c7fb2b90c72b62fff7
-
Filesize
19KB
MD5aa4734c5ba9a1a09d0b320d68e48dccc
SHA1bfaf4ef3d0894a6dad7e475e59ddffdf7af19aa2
SHA2563d28457fb3fc1a1e75cca64f62fe37c2ee98e5b930149a8a84e00daac9ae5721
SHA5126a41d830b0db5246ce21b6011e0912cdb976f0931a06bd4d3aae86bc0268c955b0c02ddb8b4d06eae59577b4b42911b6fcb15a2d9e4c24a9ed43bda046f20bc7
-
Filesize
19KB
MD54b4fc94bec4c59b08dee2b9aa104327c
SHA11b9c47d26a89fa90e097d74b6f7d769af4ba4feb
SHA2562221436fd3cb6b630bca93a4680b24d3ca86e1b7067e287a2d2b7fab7be4e6cb
SHA51290b3528702a6c635f65f7147adf5c4a7f404479122434a21b913b303a79ecc3f83950b9df8c6ba401d64d82d200d7e65cee6a524d2cdc65ceb43eef808ebd274
-
Filesize
3.6MB
MD5f250ef509af0e45d8fef25fd08cb54f4
SHA15d5e28cd925f062ef3270a461fa9e699abde7e41
SHA2562611e15ee77cb3fc1a85fcd32a29a63d8ca4917d3ff54892be1a741c242584db
SHA512d7bae504cbc62d6f71f261669b63c2901e8dc6327997b97dc558fe7ae2d7c7ffef26ac8bf1299010a3d3102a716ec08bc9e654a828736788a307d6f293f13366
-
Filesize
4.1MB
MD5537aa0f899ac790aba441a3f63a659d2
SHA1bc2b72c13d96e3da00efde6818121e69895ff60b
SHA2569a6765dc00367236dad8e45bfbead9d02034aa05cbbf011f3f19356688dc7d64
SHA5123753655a90b5836fd8f3e3f410fb9689f8396078384511d795ee9b6db88d06794775650ba172de3b24adbbfceff616fef4dafdfc44eb7c81abb8c10fd652f829
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
35.2MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
120KB
-
Filesize
280KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
84KB
-
Filesize
208KB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
4KB