Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 19:29
General
-
Target
202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169.exe
-
Size
4.1MB
-
MD5
4fce6fff0494e8b07f3a1afc97bb4c95
-
SHA1
317736f49bcff42745ebdd055e45bd9d66a70a8b
-
SHA256
202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169
-
SHA512
9a8e66e2b78e7b401312dab9349b566361395c27a8080addc1f5a62cf84170f22620fa9a8977bded5f1c2d3bdada9293593b95544f714b855afed5626290249c
-
SSDEEP
98304:KEJIWEvfJYldNz1VWpL3L0cE4bvJAyhw6eqjyZouO:KEJJEv+l7zil3jygVjyy5
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 19 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 17 IoCs
-
Detects executables Discord URL observed in first stage droppers 17 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 17 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 17 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 17 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169.exe"C:\Users\Admin\AppData\Local\Temp\202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 22803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169.exe"C:\Users\Admin\AppData\Local\Temp\202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2700 -ip 27001⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
19KB
MD52d38aa01740f2c867148a6213cda5dfe
SHA16a4950adfc4fd6277da99ac7deb192d91db023af
SHA256dbad3503ff0fc5c9468c5f4624982171e00b9b1cf86c56399fd8573e9995626e
SHA512ddedfa275c3e8528dd4fa57746d0add5b2047aa01ae52626caa1c4384835401cbf29c31450e8b78f1dc333b0100c601617a59576b00905cada23b4097a2db4e6
-
Filesize
19KB
MD5e39fd11281ba583a2dcbd5936e104a35
SHA123a437f1eb408a451436a2e20f88136cedd2d105
SHA256a375eab0cb4be000d55759b041af1b1b06879132150d60dece63f596f4e5e3c5
SHA512f11004149bc9c236f96303870030fd58e2350d45590112368cae55fa73ce55e3d48322ebbe283b21a8736c7200ac1b7a7f0af4a0489d4c2d3141444ca379cde3
-
Filesize
19KB
MD58a56e2792e068163938b18d921d9b525
SHA11041a9d29aa3949add33f9a6207f72148824b8e8
SHA2566d4ddaf7174e3b05af167297b087baebf6710d687d7ae7a1a02f630911f28a8b
SHA512455cc130244719d131dbafa7913313e5ca34bef3498d0c5c186d1eff2112abc91325a4247ecd474e1b8e5fa1d11d406d43c77b17318ab7bdbee5650f4c439acc
-
Filesize
19KB
MD511c321c997b33e8c1438f222cfb522b3
SHA1c8805f8af2eee44df2c18684b2be2d5561583869
SHA25644d094c11fe6014f2c7a96eeb6792142be03faf3c2a03a5396f7b38c9b970701
SHA512d8ebaf69599773f46c6f2bce8a6802313071478ce1bfdc780765200a32cb99958e734262a007a5fbf44fd4336795c5de3ff04f3638f42ab5a6dc3c4a863e3f3f
-
Filesize
19KB
MD5d924de02c3dd6e0506204a6dc3a1a157
SHA1f600b339edd5366c9226f8388219fa6f5103a66b
SHA256167a76f16efe39d0b4eb2b96ccd99a0c5e79e2f24fd3592ab4363664a3234592
SHA512fd2371507a9a2dc5528117563c33c5f8802babf28a6927db97b2611c6a52efb0c1412bf5895191ef2b49da66876144ba5d373326841a5fb1a2f3af9afc02c349
-
Filesize
4.1MB
MD54fce6fff0494e8b07f3a1afc97bb4c95
SHA1317736f49bcff42745ebdd055e45bd9d66a70a8b
SHA256202142386f6d9a19f3649e5de2f5f37767333c52650dba1e7aba5550aae56169
SHA5129a8e66e2b78e7b401312dab9349b566361395c27a8080addc1f5a62cf84170f22620fa9a8977bded5f1c2d3bdada9293593b95544f714b855afed5626290249c
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
56KB
-
Filesize
600KB
-
Filesize
652KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
42.9MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
42.9MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
200KB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB