Analysis
-
max time kernel
3s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
18-05-2024 21:13
General
-
Target
09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc.exe
-
Size
4.1MB
-
MD5
b88142eaf5baa7e6c537db605ec9966a
-
SHA1
993b87d06dd65f14d99cc858a08b95f350b93af6
-
SHA256
09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc
-
SHA512
b30191420729927557ad1a0b0fa3378881940a07da0008969ebeeaa5e1dd8f254c4a34e44bb74be41bb31aa34d75820d4133cb6c37b5c8fed9805f82f1284882
-
SSDEEP
98304:zmSOHuT7egJLhRTCVEkOCdqjiWtSbuAFmh92D:z0ObLh9WfG/tSdes
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 19 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc.exe"C:\Users\Admin\AppData\Local\Temp\09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc.exe"C:\Users\Admin\AppData\Local\Temp\09ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
19KB
MD501629c2e5510a9a7cdc5836d2d08a773
SHA175a22ba7f5d5e5a3adfa1a7fa3472a46201c6d78
SHA256271a7272237b83bda6c0c33c048fd49a4687076f26caaa73269ed7c6601632a5
SHA5120f00caf18ba1c8407c70a9f51396b40fc3a48a23ce29e285fd9a5dcc1b5e7cf8e77452f115ceb399f745e2da1a936be02c6b8b65d3abd7481f873863a7e57620
-
Filesize
19KB
MD561933957c02876ae9161731d8f9d99b3
SHA1cf50d9f679f2751ef11c1195488f8792e71f3497
SHA25640c4db33b58868ba8ff647a8cb41cbff07035d69dd3aa412328745db11eff4b4
SHA51233f60a49f850717208c7d9fd751fe6723acf5615c592f943220580b633cfcacad6d441c201866f69c07ba3872c0ba1a82a13f1c912ee862064b760e26fd12b40
-
Filesize
19KB
MD551e27d9b6c5c3b34214dadca2e08302d
SHA1b3c46bf556e8f2a675b4d3464ea70482f112fced
SHA2565aa989de7e2469c2c9ccbf00713ab070f289ff90265d424064ab4f2a469dafc3
SHA512efd14c26db0bef9f8441b21fc92be769bfbe4cab6407caefa57fd01a9a98e19440b79200211166e39ada59575d61d1d017e9d05f9070d0c6e8b7b4f510c89e1b
-
Filesize
19KB
MD573f78e0a696280ff5289aa366c1012dc
SHA19cb437fe9f745f0ae8e9cca9bf57145f810ba4e6
SHA256f0e851b55a06e830822aeab99d8d6414520818896d3ff4f046ba6b8213819169
SHA512006d845519de0941ee09469d21ecdd440feebf0658a0f0069955463289520cf7283f58a9fd4932f4504d33e34bdf710c82d7f0dc3e58c4ee562244045d3b059f
-
Filesize
19KB
MD571919e88d89ebd3e1a1ffd181af76aa2
SHA1e6d5a458c7842db7ecb2962e5a40e302ae32382b
SHA2565f57d5caaeaecc711df809da3af0950d9f1b31f1f9c6a7a38f3ab3c4b6ee4c4d
SHA512351c7e7f5f5ba163697f7527b0ca9005f34a3619c52e5920eec834bd22942f0c16dc50db1684b256740092baa1393af9c29cfb9012ae9a76a6b687954dfe2018
-
Filesize
4.1MB
MD5b88142eaf5baa7e6c537db605ec9966a
SHA1993b87d06dd65f14d99cc858a08b95f350b93af6
SHA25609ce87d0be43cd78c49db505ee59b33bfe233d1a380dcce7efc77102b0c411dc
SHA512b30191420729927557ad1a0b0fa3378881940a07da0008969ebeeaa5e1dd8f254c4a34e44bb74be41bb31aa34d75820d4133cb6c37b5c8fed9805f82f1284882
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
35.2MB
-
Filesize
6.5MB
-
Filesize
3.3MB
-
Filesize
56KB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
280KB
-
Filesize
408KB
-
Filesize
208KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
656KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
3.3MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
35.2MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB