Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
19/05/2024, 11:17
General
- Target b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770.exe
- Size 4.1MB
- Sample240519-ndtpzsfc69
- SHA256 b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 19 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 7 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770.exe"C:\Users\Admin\AppData\Local\Temp\b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770.exe"C:\Users\Admin\AppData\Local\Temp\b92d002fb2ed3ae2ddb1c207f44917156bae55c032589abbcbd1e63bd1d2d770.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q1f5gyso.itu.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
windefender.exe
memory/488-125-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1212-112-0x00000000710B0000-0x0000000071407000-memory.dmp
memory/1212-111-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/1464-226-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-218-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-214-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-234-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-212-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-232-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-230-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-216-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-220-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-222-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-202-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-224-0x0000000000400000-0x0000000002364000-memory.dmp
memory/1464-228-0x0000000000400000-0x0000000002364000-memory.dmp
memory/3204-217-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3204-210-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3204-213-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3308-187-0x0000000070EB0000-0x0000000071207000-memory.dmp
memory/3308-186-0x0000000070D30000-0x0000000070D7C000-memory.dmp
memory/3580-2-0x0000000004570000-0x0000000004E5B000-memory.dmp
memory/3580-53-0x0000000004570000-0x0000000004E5B000-memory.dmp
memory/3580-54-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3580-51-0x0000000000400000-0x0000000002364000-memory.dmp
memory/3580-3-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/3580-1-0x0000000004170000-0x000000000456A000-memory.dmp
memory/3596-150-0x0000000006690000-0x00000000066A5000-memory.dmp
memory/3596-149-0x0000000007D00000-0x0000000007D11000-memory.dmp
memory/3596-137-0x0000000006900000-0x000000000694C000-memory.dmp
memory/3596-138-0x0000000070E10000-0x0000000070E5C000-memory.dmp
memory/3596-139-0x0000000071050000-0x00000000713A7000-memory.dmp
memory/3596-148-0x0000000007B30000-0x0000000007BD4000-memory.dmp
memory/3756-89-0x00000000058A0000-0x0000000005BF7000-memory.dmp
memory/3756-91-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/3756-92-0x0000000071050000-0x00000000713A7000-memory.dmp
memory/3924-207-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3924-211-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4224-63-0x00000000061E0000-0x0000000006537000-memory.dmp
memory/4224-77-0x0000000007CD0000-0x0000000007CE5000-memory.dmp
memory/4224-76-0x0000000007C80000-0x0000000007C91000-memory.dmp
memory/4224-75-0x0000000007960000-0x0000000007A04000-memory.dmp
memory/4224-66-0x00000000710B0000-0x0000000071407000-memory.dmp
memory/4224-65-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/4224-64-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/4512-24-0x0000000007A10000-0x0000000007A44000-memory.dmp
memory/4512-22-0x0000000006610000-0x000000000665C000-memory.dmp
memory/4512-47-0x0000000007CC0000-0x0000000007CC8000-memory.dmp
memory/4512-46-0x0000000007CA0000-0x0000000007CBA000-memory.dmp
memory/4512-45-0x0000000007C50000-0x0000000007C65000-memory.dmp
memory/4512-4-0x0000000074B3E000-0x0000000074B3F000-memory.dmp
memory/4512-44-0x0000000007C40000-0x0000000007C4E000-memory.dmp
memory/4512-5-0x0000000002E10000-0x0000000002E46000-memory.dmp
memory/4512-6-0x0000000005810000-0x0000000005E3A000-memory.dmp
memory/4512-7-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/4512-8-0x0000000005E80000-0x0000000005EA2000-memory.dmp
memory/4512-9-0x0000000006020000-0x0000000006086000-memory.dmp
memory/4512-11-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/4512-43-0x0000000007BF0000-0x0000000007C01000-memory.dmp
memory/4512-42-0x0000000007CE0000-0x0000000007D76000-memory.dmp
memory/4512-41-0x0000000007BD0000-0x0000000007BDA000-memory.dmp
memory/4512-39-0x00000000081E0000-0x000000000885A000-memory.dmp
memory/4512-40-0x0000000007B90000-0x0000000007BAA000-memory.dmp
memory/4512-38-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/4512-25-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
memory/4512-37-0x0000000007A70000-0x0000000007B14000-memory.dmp
memory/4512-36-0x0000000007A50000-0x0000000007A6E000-memory.dmp
memory/4512-26-0x0000000070F20000-0x0000000071277000-memory.dmp
memory/4512-28-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/4512-23-0x0000000006B60000-0x0000000006BA6000-memory.dmp
memory/4512-50-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/4512-21-0x00000000065D0000-0x00000000065EE000-memory.dmp
memory/4512-20-0x0000000006150000-0x00000000064A7000-memory.dmp
memory/4512-10-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/4948-175-0x0000000005F20000-0x0000000005F35000-memory.dmp
memory/4948-174-0x00000000078C0000-0x00000000078D1000-memory.dmp
memory/4948-163-0x0000000070D30000-0x0000000070D7C000-memory.dmp
memory/4948-164-0x0000000070EB0000-0x0000000071207000-memory.dmp
memory/4948-173-0x00000000076E0000-0x0000000007784000-memory.dmp
memory/4948-162-0x00000000064F0000-0x000000000653C000-memory.dmp
memory/4948-160-0x0000000005FE0000-0x0000000006337000-memory.dmp