glupteba | ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c

Analysis

max time kernel
7s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Size

4.1MB
MD5

8f1e4ee65e57ba509d34471bd128ca9c
SHA1

1193ff42997f774d0d530b80b88db60952a89cde
SHA256

ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c
SHA512

d9f1ea8d7eafe928fe9282da91d15c4f4f59cfc75e62557530c6be950e2654d18d5742bafb52c66ae3a1e135b2fb995faa340dee54184a477124d6f5d9c264be
SSDEEP

98304:UX33DbWGkLHuFK+TwQmBC6reQ4TTNXYvI8KgvjrB0rm:UXPWAwQyCdJYw8Kggm

Score

10^/10

glupteba dropper evasion execution loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3592-2-0x0000000004870000-0x000000000515B000-memory.dmp	family_glupteba
behavioral1/memory/3592-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/3592-144-0x0000000004870000-0x000000000515B000-memory.dmp	family_glupteba
behavioral1/memory/3592-142-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/1236-184-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/3592-213-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4312-215-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-227-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-231-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-235-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-239-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-243-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-247-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-251-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-255-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-259-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-263-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-267-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral1/memory/4312-271-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4428 netsh.exe

pid	process
4428	netsh.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/508-221-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Windows\windefender.exe	upx
behavioral1/memory/372-223-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/508-225-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/372-229-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/372-237-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5000 sc.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

4204 powershell.exe
2548 powershell.exe
3496 powershell.exe
4588 powershell.exe
3704 powershell.exe
4860 powershell.exe
1108 powershell.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2880 schtasks.exe
4084 schtasks.exe

pid	process
5000	sc.exe

pid	process
2880	schtasks.exe
4084	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exepowershell.exe

pid	process
4204	powershell.exe
4204	powershell.exe
3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
2548	powershell.exe
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Token: SeImpersonatePrivilege	3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
Token: SeDebugPrivilege	2548	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exeba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe

description	pid	process	target process
PID 3592 wrote to memory of 4204	3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe
PID 3592 wrote to memory of 4204	3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe
PID 3592 wrote to memory of 4204	3592	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe
PID 1236 wrote to memory of 2548	1236	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe
PID 1236 wrote to memory of 2548	1236	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe
PID 1236 wrote to memory of 2548	1236	ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
"C:\Users\Admin\AppData\Local\Temp\ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Users\Admin\AppData\Local\Temp\ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe
"C:\Users\Admin\AppData\Local\Temp\ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c.exe"
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:5016

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4588

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
PID:4312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Command and Scripting Interpreter: PowerShell
PID:3704

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2880

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Command and Scripting Interpreter: PowerShell
PID:1108

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
PID:2884

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4084

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
PID:508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:3788

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:5000

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgqj51m1.rvx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
d643a64a87b7eeb41a540b72fbab48c7

SHA1
5e00100659b10bdaef33eb805dd065f9b4dded36

SHA256
4a6c1d6b0e0c359e8ed895ef31ac77abd31eab800da8eec5307706cc6a05c7a2

SHA512
4dfc534b249b423caee68c72005a6ac6508addff7fb7dc1d74d1a4cfafa54dc58d8776424dfcacf7c4f89fe6ad08eba1d7dce9d3cb9fcda4ad055166bca32c74

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e6d30ea9f40b3cb8c451ca7931bb8574

SHA1
a4f76c6a6048c513e9003fb2e4586366842b670a

SHA256
59fd84166196f4eb1323f7762734810a4a7bcda8fee57b00d51b6596cad8bcc2

SHA512
00a56d772c2bc5ca63842de2b392a22031dcb39da9410d55227c798dc955ceeda948dad4aa01227b79895b24510ef7cf84fffe496971c29600c6b04248e93b8f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0bf42be24fc9192d655ce0674281e87d

SHA1
93a81be35a6795cca80ea2bf89f8c489a809d9eb

SHA256
26c2ac6692cd08a7ec732a8c3862c441ce339fcaa72e8ae5bd983739c76d00d6

SHA512
2f260d2df5a5f42e68ac105d32c19cea6f95303d6c4e0881dbcc2de5ec31828b417a356732aa48c011bade43147e51945f75367c5b05b72a448fb9ae4d3138f7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
14f26abb43b44d07b2ab1e550380a2a6

SHA1
712355b479a739cb9e1d82eb67de00db2a43ee76

SHA256
a5f4568bb83e9cde39550f0908dca5046c5c556b01826cf0e421170f285044ff

SHA512
9c4490210f2967e6989a1bb8bf5b177e6e7f7bbb5954e3515b8f5cb0c44dfd4581d64b9b8da00d5b67effcc30acb92cf58aa8f92d91178973f2b565ce50700d7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
cf0132d29ec38995ee5cde7bc758051e

SHA1
e5a92f3749ade7708519daa4129ea906bb092e51

SHA256
7747a7c79114f5621a843510080a7acca69c062af84cf4e66f8cbd3746d03f7d

SHA512
f001af505f4bf0ecdd9e5ad5fe9cef912a7b141d38295c50da00695de9dcdc7acd18ecf33acf57ae32cbcd50f877628c42ea79d11a25f98803c39611ab714150

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
8f1e4ee65e57ba509d34471bd128ca9c

SHA1
1193ff42997f774d0d530b80b88db60952a89cde

SHA256
ba7e3d962063c2138062e25d31df4a930af2dce4bfcf4439f4d8e650805e907c

SHA512
d9f1ea8d7eafe928fe9282da91d15c4f4f59cfc75e62557530c6be950e2654d18d5742bafb52c66ae3a1e135b2fb995faa340dee54184a477124d6f5d9c264be

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/372-237-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/372-229-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/372-223-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/508-221-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/508-225-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1108-194-0x0000000005860000-0x0000000005BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1108-196-0x0000000070C90000-0x0000000070CDC000-memory.dmp

Filesize
304KB

Download
memory/1108-197-0x0000000070E30000-0x0000000071184000-memory.dmp

Filesize
3.3MB

Download
memory/1236-184-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/2548-77-0x0000000007500000-0x0000000007514000-memory.dmp

Filesize
80KB

Download
memory/2548-65-0x00000000714F0000-0x0000000071844000-memory.dmp

Filesize
3.3MB

Download
memory/2548-76-0x00000000074B0000-0x00000000074C1000-memory.dmp

Filesize
68KB

Download
memory/2548-64-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Filesize
304KB

Download
memory/2548-75-0x0000000007210000-0x00000000072B3000-memory.dmp

Filesize
652KB

Download
memory/3496-92-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Filesize
304KB

Download
memory/3496-90-0x00000000060C0000-0x0000000006414000-memory.dmp

Filesize
3.3MB

Download
memory/3496-93-0x0000000071B20000-0x0000000071E74000-memory.dmp

Filesize
3.3MB

Download
memory/3592-2-0x0000000004870000-0x000000000515B000-memory.dmp

Filesize
8.9MB

Download
memory/3592-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3592-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3592-142-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/3592-144-0x0000000004870000-0x000000000515B000-memory.dmp

Filesize
8.9MB

Download
memory/3592-143-0x0000000004460000-0x0000000004867000-memory.dmp

Filesize
4.0MB

Download
memory/3592-1-0x0000000004460000-0x0000000004867000-memory.dmp

Filesize
4.0MB

Download
memory/3704-145-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Filesize
304KB

Download
memory/3704-146-0x0000000071520000-0x0000000071874000-memory.dmp

Filesize
3.3MB

Download
memory/4204-5-0x0000000002590000-0x00000000025C6000-memory.dmp

Filesize
216KB

Download
memory/4204-17-0x0000000005550000-0x00000000058A4000-memory.dmp

Filesize
3.3MB

Download
memory/4204-42-0x0000000007160000-0x0000000007203000-memory.dmp

Filesize
652KB

Download
memory/4204-30-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4204-43-0x0000000007250000-0x000000000725A000-memory.dmp

Filesize
40KB

Download
memory/4204-26-0x00000000075D0000-0x0000000007C4A000-memory.dmp

Filesize
6.5MB

Download
memory/4204-31-0x00000000714F0000-0x0000000071844000-memory.dmp

Filesize
3.3MB

Download
memory/4204-29-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Filesize
304KB

Download
memory/4204-28-0x0000000007100000-0x0000000007132000-memory.dmp

Filesize
200KB

Download
memory/4204-27-0x0000000006F50000-0x0000000006F6A000-memory.dmp

Filesize
104KB

Download
memory/4204-45-0x0000000007360000-0x00000000073F6000-memory.dmp

Filesize
600KB

Download
memory/4204-4-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/4204-25-0x0000000006CA0000-0x0000000006D16000-memory.dmp

Filesize
472KB

Download
memory/4204-24-0x00000000060D0000-0x0000000006114000-memory.dmp

Filesize
272KB

Download
memory/4204-53-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4204-50-0x00000000072F0000-0x00000000072F8000-memory.dmp

Filesize
32KB

Download
memory/4204-49-0x0000000007300000-0x000000000731A000-memory.dmp

Filesize
104KB

Download
memory/4204-48-0x00000000072C0000-0x00000000072D4000-memory.dmp

Filesize
80KB

Download
memory/4204-47-0x00000000072A0000-0x00000000072AE000-memory.dmp

Filesize
56KB

Download
memory/4204-44-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4204-23-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Filesize
304KB

Download
memory/4204-6-0x0000000004CC0000-0x00000000052E8000-memory.dmp

Filesize
6.2MB

Download
memory/4204-7-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4204-46-0x0000000007260000-0x0000000007271000-memory.dmp

Filesize
68KB

Download
memory/4204-8-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4204-9-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Filesize
136KB

Download
memory/4204-10-0x00000000053F0000-0x0000000005456000-memory.dmp

Filesize
408KB

Download
memory/4204-22-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/4204-41-0x0000000007140000-0x000000000715E000-memory.dmp

Filesize
120KB

Download
memory/4204-11-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/4312-255-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-271-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-267-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-263-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-215-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-259-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-239-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-251-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-247-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-227-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-243-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-231-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4312-235-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4588-116-0x0000000071520000-0x0000000071874000-memory.dmp

Filesize
3.3MB

Download
memory/4588-113-0x0000000005490000-0x00000000057E4000-memory.dmp

Filesize
3.3MB

Download
memory/4588-115-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Filesize
304KB

Download
memory/4860-182-0x0000000005A90000-0x0000000005AA4000-memory.dmp

Filesize
80KB

Download
memory/4860-165-0x0000000005580000-0x00000000058D4000-memory.dmp

Filesize
3.3MB

Download
memory/4860-168-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

Filesize
304KB

Download
memory/4860-169-0x0000000070C90000-0x0000000070CDC000-memory.dmp

Filesize
304KB

Download
memory/4860-180-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Filesize
652KB

Download
memory/4860-170-0x0000000071420000-0x0000000071774000-memory.dmp

Filesize
3.3MB

Download
memory/4860-181-0x0000000007200000-0x0000000007211000-memory.dmp

Filesize
68KB

Download