Analysis
-
max time kernel
0s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
18-05-2024 11:32
General
-
Target
e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee.exe
-
Size
4.1MB
-
MD5
a12de8c9a4b6d27e50759de42f5d4431
-
SHA1
94adcdfc90c5c36f9df5062ebdde51deeae632d2
-
SHA256
e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee
-
SHA512
d474f7ac01279399d084805f9cf8abf82cad14aeb27127edb0ce9198c966536b6d6e9a840038191f193cae3f6f203de278a2b1746cb1a3bce466f1d728422002
-
SSDEEP
98304:4Z9bi3QNEOtUId2petU9sYIhWVMAA4+H7:R303UIApyYIhWVMEy
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 10 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee.exe"C:\Users\Admin\AppData\Local\Temp\e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee.exe"C:\Users\Admin\AppData\Local\Temp\e976a1972323f0a4050129f375edf3c74b19587f4c42685d780f87755538dfee.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD59a407cb8ce14cd9143fa6f25c74f6486
SHA1536a2707e16c9b3fc4ff6df62e5ce2d3bbd81108
SHA256a1b7ca4e78042e26bfa4496708432732372806fc38793c3c54d472b81a57bf8a
SHA512ee8af6b467012cc2ef64eabdaf871be707d29612e4aabea424e0a46029e2f05cb4f1f60f8e5a6c195ffbbd30a63648ddf3031e2180d7c047e91fa4753d1aa9d6
-
Filesize
19KB
MD51e2c576299b64d916e1194a2f49566ca
SHA14471acbbf21a40993f2ed1289e0fa23859402dea
SHA256584c0ab38ff82d252b5754d74730687007ca9dea7df4a021f693afe170ddf939
SHA5120f75950b42328f908f27f08c8d5c4a850f936acdc86d7a10b9eaec7b5103c483538ca1561f21d83a34aadc258dad02add2ecc0e8afe109d239cac25d106c21d2
-
Filesize
19KB
MD5ed7babf0a58ee9980db9e902745fdca5
SHA172c92c34ac0a714d95ae7ccb3a15e735a9283932
SHA2562a4bfc68627023e05b5bac1c5d9db20f9b398c50feb93f59fc1bb8b9113705ca
SHA512484249120210f01d1e1862d4cb1ca8329d472eb117bf69a3f24cbee03024a1cc3196f5261d3c1b04461c364fea6de47e3fa2c64c608d37fa917efb7ba6a0068a
-
Filesize
19KB
MD51acbfb09a783ad9b19217b1851e6b09b
SHA1d26ee42300fe22af95423f13e9f0f6fca5a2ee80
SHA2563f5e1dc72ce4be3c32ef4fd891ca2f00c2bcf208acf4b1e56c6b3cfb233cea4c
SHA51205d364c8f6fe15a041649113367c13838981a77fff52e43cab82c1956ff4a5626e2f3242cb78bff43b931c869033880637f29c15075f209735f4a576a6fdd3a8
-
Filesize
19KB
MD57b92bae169cb826c0031ae96e654a2eb
SHA10e0e996a40630aa5b495ba466a3ea0e0944ed498
SHA2565e3f03071f35848e70aa41631bf223b320e1f7aa9de96f70ce900c07e4062c93
SHA5121e9922b12c66f456645a35f180fb6ed797da333077b746dc10aff24f8101e27436670a13d57131cd79ed3530717e20b64c088585b0b8ce423439497274ea70f4
-
Filesize
2.1MB
MD52099722686d94a446026f9e1e30a41aa
SHA1b7d79e2f217758e868262b3b216bca5c1babc685
SHA2561af2478062bc2a374a5bb11e45c3a6a4fc6fe08149c3add412e51b93b906b0de
SHA512906abe05050bc6e180e4d25a0197260221b30ef3caf5378b496c0b7a96a9a5e9aec4ec6efe39f58a866c19a771e6ff6e8ce8de381045c3f428e1ffb016b91409
-
Filesize
1.2MB
MD5a43d1181c5c818d7d78e782ec1828903
SHA1ce87b6b09f2b30c85a2420d7e1471a0c2db55475
SHA25657b26db83b472d3aa74fdc739ae2a2aab69513a334cc9850d2adc81053093cf4
SHA5125985d550e97d5a383a3b121dd3c42ef032f3815afa7ac6ff35c0935fb143c51c5ac0406b0dd854c1936aff98d8da964ba1c390187b81380ee891ac8708cdd6d4
-
Filesize
448KB
MD5eac3c94e166a4ac3e7d3dbf26d505ebb
SHA1c231e723ad6077f9b6bd12c5e7bd3fd208f7fa45
SHA256662eb9030b85d481e53772eb13a1b747a62bc68a862e0e4ba90f4e6acb3fe124
SHA512b5b0f2d3205ebf43593ae73318cc078b5eafed92be6c8d113cf0e7dbef9f84da759301393b9528ac7f11b2f82dd8a190ad5c2b9066c84afbc1c9fb775fcff1a0
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
652KB
-
Filesize
68KB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
39.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
136KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
39.0MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB