Analysis
-
max time kernel
0s -
max time network
144s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
18-05-2024 21:20
General
-
Target
66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd.exe
-
Size
4.1MB
-
MD5
939ee58b3e5bb32699cbf795c3410efe
-
SHA1
a0d993cf7cbf6515d451c489cdfb0248fa68bf09
-
SHA256
66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd
-
SHA512
2c812ecfa7202c04654099ba8aec74d7690c82aa2003db8a8def809464b7a7da1f46a12309ae73c6b4f58bea789de8480afa74f5b71b2d799ebd492c7707ac4b
-
SSDEEP
98304:7mSOHuT7egJLhRTCVEkOCdqjiWtSbuAFmh92D:70ObLh9WfG/tSdeo
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 16 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd.exe"C:\Users\Admin\AppData\Local\Temp\66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd.exe"C:\Users\Admin\AppData\Local\Temp\66fbd0d108deb35f95573c71450dc4e3a4341b8df12b377c56e3f7be07d9a6bd.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
Filesize
19KB
MD5b161af57d8923971dd4df1a3af8d6d5e
SHA1e440c72d496d8a2e658691486a151d7f7f7e2811
SHA25662c2b126345b5378869c580edccbc9f58785d48d01b69b72b9e81898a408976b
SHA5128d5496348aba4721d0dda0e478c52f7f13f4d0bfb167de9335b60983d939a73bf409ee2d908d5497a3f18fa15fc6344d8434eeeaef5452c8b492a1a1be6777e3
-
Filesize
19KB
MD512fafcddec7d08a71896fe5ba5227e90
SHA1df0602f387009c36f283e72c778e840dc54c44a9
SHA25659da87abbf72c01521c3c7de4799be6156703a30b8d65cceb1515d32cc9afd4a
SHA5121d7dd2240be2cad2726554ce16349419e9f4a6571b51d44b0988e256af9dcd97984033526be4447fb29dd75b66df97b8cd0a7ec266ee68b971fb004f981d77bc
-
Filesize
19KB
MD5dbc541bc8ad90a14a94f43450508559b
SHA1a698fa2c9fe67b1739f9fac356cdb19d219330b7
SHA2561ea1cb416904fdba6f0886f1bec5db2789298199ae1a23e765cffec11b5aaeba
SHA512a07086c6815ee24e86669016c04f761f3253dde9d47717ddd48e9d842e6c83aae6fbc4194fa2b74405be75bf1914f495dd75e2de79933e905de73910471260bd
-
Filesize
19KB
MD515d5c04a68fbcf0a8ab1c34885775390
SHA17eac1c0501a758ae736d2598114be11342561c04
SHA256a934e9fc58a7b846069ee7e587523c6303423e0086767e9a7817048c076bc238
SHA512be0f591bb3fb67e2aa70289e27242613a74071788bd6433b0c9ef52f96b23b9592a0ed62642a0ae14b1a8edd2ab7e2f0d0a4b16a9310086305050cace0e12a9f
-
Filesize
19KB
MD52d861c38b603039346534d5aaa5ddf30
SHA1f751fe873810827fe57214a466d71abe9553480c
SHA2564949e237a552a7c355848087c5aa3e0f2196c61e08fc878d77524a0e8d9bba52
SHA51243834e556ed4a17b5b6d83ab2e2ff8899f07e0a00cc03127fd7f972e9b640ba69cbf0a850d3202174b5a704db46ba7fa0582cd6e22321b75781f4485f1f8ab5d
-
Filesize
3.6MB
MD58cfaf6df9e519c1a343bf5a1e635446f
SHA1f282b65ff962aad64fe19061c58faa3c71417552
SHA256faf294682892e3ea109f74d61d1d3b7d224c1abd1e7ccb011e79ce0e42ac0e33
SHA512b9be52f9552e447aaae8d9df7afb99ee1fa871d10d111e1561bcb54a65fe8688a04ae5f9147bdc15cea266ae951968b64188d486bdce0395972b23ff921491c3
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
35.2MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
4.9MB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
4.9MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.0MB
-
Filesize
35.2MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
208KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
84KB
-
Filesize
280KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB