Analysis
-
max time kernel
100s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18-05-2024 11:02
General
-
Target
144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028.bin.bin.exe
-
Size
4.1MB
-
MD5
da57e4cfdacfc7c09fee333949a64997
-
SHA1
14fe352185eb6fb12fb20a103c2a118230dab52d
-
SHA256
144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028
-
SHA512
aec750592d703509b7173b4660fe5d8f1c66a0f746d4c135f223cd4ad56ade3e52cece93b8d0532e6cb91945640c221bed935241bade05bd24cf49867cdd6a7b
-
SSDEEP
98304:vQx32Mq02zAeaet/0/YHlEVnWsL/fnVsJseCa8CK6QwXNx08FP:4x32Mq02zAeLCVnWszfVfeCa8CLXv/1
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 12 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028.bin.bin.exe"C:\Users\Admin\AppData\Local\Temp\144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028.bin.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028.bin.bin.exe"C:\Users\Admin\AppData\Local\Temp\144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028.bin.bin.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD5beac7495020e71f133966e3c11cf8115
SHA1a3e69bd354ae0e29fe75fb40570f02f6b4d1a4ff
SHA256df88de7c2aad834ac1f910229224e1cd560bf78bd52ed123b13c7b2d11c509ca
SHA5124b54a47a3242fdcd7d389dd10f99eac2e92a9a5dd47fc8f2a9146494535497ccd1de884e544fc48da00cd3ef75b20067acde5310d589722fab5820ed8ce5a782
-
Filesize
19KB
MD5aff9c45936dbc323f5cd8abedafd5e0b
SHA158b7c8b21a347f8cc31d88be5cc65940095981f0
SHA256f73ec5203d89e860462eaff3f7da819e70f5eb762bfc8a9ca87ea60e5380cc12
SHA512dd06c97742c403902f1c4babe3c9a2861573679d58c65877ca8d68aab4cfdaa5abe9d55c0b6a83991b991ccff35f3c2fb230462dbbbcbddb0adba2295201561f
-
Filesize
19KB
MD5e69aadf85abac84ab23c142e7408675b
SHA1a8dfd5c218f24f27d0e67f98894ca8b97af28e48
SHA2566661d6147b6840588253a8d7f867a87abff656ad449f59d33eee16d248a79e18
SHA512bb534fc452edee84264bbeadd9ebec7c882a1f9fad7d84c00feaa198927539678564ba4a3610c24d6c0738d5cec27ecea237bdd70ddc1b7d5768758503bc288e
-
Filesize
19KB
MD5ce44319aeac6d013a20656b08bc217fc
SHA1a5779f5fde27b4bf63b7b837956a5a167088849e
SHA25695c1ca23325fb6e09ca7c79753733098fcf18f160c95badf5c9236b4b8f81377
SHA5123a1918ecba1b4183ec82b8ca05bf6595769d42ae28e9a235a59d525f63464e9d8a7e9f7c4677d4674f6b6641523b65e76e77b0269556918ef662dd1647636bb3
-
Filesize
19KB
MD57879a1059d1e3fc8d9003a756627671b
SHA169e8a57ac3a9a4ba2485f1fa0f33f3ef79664e68
SHA2565c95347c13ffa31e740cfd28deb9ac51f9076d8e292f1cd61c41b052e3be5381
SHA512368f51ea2de4795044b788f6e74b76f8941052ba3532c7bafc95a28a887703608a7afe492f73f14c6b6365d18ce7e4c4f6f944bca625246951d300d51c6ae8b6
-
Filesize
4.1MB
MD5da57e4cfdacfc7c09fee333949a64997
SHA114fe352185eb6fb12fb20a103c2a118230dab52d
SHA256144506f4b81d7f56225ac49ff447c49a56b48f943a3a880b0e83f96caae21028
SHA512aec750592d703509b7173b4660fe5d8f1c66a0f746d4c135f223cd4ad56ade3e52cece93b8d0532e6cb91945640c221bed935241bade05bd24cf49867cdd6a7b
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
4.9MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
272KB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
39.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
39.1MB
-
Filesize
4.0MB
-
Filesize
39.1MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
3.3MB