Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
19/05/2024, 20:43
General
- Target 335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2.exe
- Size 4.1MB
- Sample240519-zhkhnagh78
- SHA256 335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 19 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 7 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2.exe"C:\Users\Admin\AppData\Local\Temp\335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2.exe"C:\Users\Admin\AppData\Local\Temp\335167cca0ec369057e1146ed6396a9dd002eb69936774a9d77f5a3060dd21c2.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xnv2nkf1.doq.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
windefender.exe
memory/108-165-0x0000000070FD0000-0x000000007101C000-memory.dmp
memory/108-164-0x0000000006820000-0x000000000686C000-memory.dmp
memory/108-162-0x0000000005E20000-0x0000000006177000-memory.dmp
memory/108-166-0x0000000071150000-0x00000000714A7000-memory.dmp
memory/108-175-0x0000000007570000-0x0000000007614000-memory.dmp
memory/108-176-0x00000000078C0000-0x00000000078D1000-memory.dmp
memory/108-177-0x0000000005D90000-0x0000000005DA5000-memory.dmp
memory/992-91-0x00000000712D0000-0x0000000071627000-memory.dmp
memory/992-90-0x0000000071150000-0x000000007119C000-memory.dmp
memory/1228-5-0x0000000003490000-0x00000000034C6000-memory.dmp
memory/1228-11-0x0000000006430000-0x0000000006496000-memory.dmp
memory/1228-35-0x0000000007DB0000-0x0000000007DCE000-memory.dmp
memory/1228-38-0x0000000074DD0000-0x0000000075581000-memory.dmp
memory/1228-40-0x0000000007F00000-0x0000000007F1A000-memory.dmp
memory/1228-39-0x0000000008540000-0x0000000008BBA000-memory.dmp
memory/1228-41-0x0000000007F40000-0x0000000007F4A000-memory.dmp
memory/1228-42-0x0000000008050000-0x00000000080E6000-memory.dmp
memory/1228-43-0x0000000007F60000-0x0000000007F71000-memory.dmp
memory/1228-44-0x0000000007FB0000-0x0000000007FBE000-memory.dmp
memory/1228-45-0x0000000007FC0000-0x0000000007FD5000-memory.dmp
memory/1228-46-0x0000000008010000-0x000000000802A000-memory.dmp
memory/1228-47-0x0000000008040000-0x0000000008048000-memory.dmp
memory/1228-50-0x0000000074DD0000-0x0000000075581000-memory.dmp
memory/1228-24-0x0000000007D50000-0x0000000007D84000-memory.dmp
memory/1228-21-0x0000000006930000-0x000000000694E000-memory.dmp
memory/1228-22-0x00000000069E0000-0x0000000006A2C000-memory.dmp
memory/1228-4-0x0000000074DDE000-0x0000000074DDF000-memory.dmp
memory/1228-36-0x0000000074DD0000-0x0000000075581000-memory.dmp
memory/1228-20-0x00000000064A0000-0x00000000067F7000-memory.dmp
memory/1228-9-0x0000000005AA0000-0x0000000005AC2000-memory.dmp
memory/1228-7-0x0000000005C50000-0x000000000627A000-memory.dmp
memory/1228-8-0x0000000074DD0000-0x0000000075581000-memory.dmp
memory/1228-6-0x0000000074DD0000-0x0000000075581000-memory.dmp
memory/1228-25-0x0000000071040000-0x000000007108C000-memory.dmp
memory/1228-26-0x00000000711D0000-0x0000000071527000-memory.dmp
memory/1228-37-0x0000000007DD0000-0x0000000007E74000-memory.dmp
memory/1228-10-0x0000000005BC0000-0x0000000005C26000-memory.dmp
memory/1228-23-0x0000000006EA0000-0x0000000006EE6000-memory.dmp
memory/2044-184-0x00000000056E0000-0x0000000005A37000-memory.dmp
memory/2044-189-0x0000000070FD0000-0x000000007101C000-memory.dmp
memory/2044-190-0x00000000711E0000-0x0000000071537000-memory.dmp
memory/2400-152-0x0000000004DB0000-0x0000000004DC5000-memory.dmp
memory/2400-151-0x0000000006EE0000-0x0000000006EF1000-memory.dmp
memory/2400-141-0x0000000071230000-0x0000000071587000-memory.dmp
memory/2400-150-0x0000000006CB0000-0x0000000006D54000-memory.dmp
memory/2400-137-0x00000000055C0000-0x0000000005917000-memory.dmp
memory/2400-139-0x0000000005AB0000-0x0000000005AFC000-memory.dmp
memory/2400-140-0x00000000710B0000-0x00000000710FC000-memory.dmp
memory/2492-2-0x0000000004B00000-0x00000000053EB000-memory.dmp
memory/2492-51-0x0000000000400000-0x0000000002733000-memory.dmp
memory/2492-1-0x00000000046F0000-0x0000000004AF5000-memory.dmp
memory/2492-53-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2492-3-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2492-54-0x0000000004B00000-0x00000000053EB000-memory.dmp
memory/2748-111-0x0000000071150000-0x000000007119C000-memory.dmp
memory/2748-112-0x0000000071390000-0x00000000716E7000-memory.dmp
memory/2748-101-0x0000000006100000-0x0000000006457000-memory.dmp
memory/3084-121-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3084-126-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-218-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-226-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-234-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-232-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-231-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-228-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-205-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-220-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-216-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-224-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-223-0x0000000000400000-0x0000000002733000-memory.dmp
memory/3624-215-0x0000000000400000-0x0000000002733000-memory.dmp
memory/4168-214-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4168-209-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4660-227-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4660-221-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4660-217-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4660-212-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4864-77-0x00000000074A0000-0x00000000074B5000-memory.dmp
memory/4864-64-0x0000000005F60000-0x0000000005FAC000-memory.dmp
memory/4864-76-0x0000000007450000-0x0000000007461000-memory.dmp
memory/4864-75-0x0000000007120000-0x00000000071C4000-memory.dmp
memory/4864-66-0x00000000712D0000-0x0000000071627000-memory.dmp
memory/4864-65-0x0000000071150000-0x000000007119C000-memory.dmp
memory/4864-63-0x0000000005A70000-0x0000000005DC7000-memory.dmp