Analysis
-
max time kernel
8s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
07-06-2024 01:01
General
-
Target
050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca.exe
-
Size
4.1MB
-
MD5
58aeec23aa477acc489ca29fc8222e5e
-
SHA1
fd189a7331274779548164e9a5c19f7c82bb287d
-
SHA256
050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca
-
SHA512
4f6ce8c769d27fa6b1b2c640ba22c995eabcec9c530221678d60a356c80c43a9a8eb47bafb16d3dc18f9f4d352fc5cf334d6d0076ac87251ee121a446ffe2176
-
SSDEEP
98304:mJsMjtvpLhBsrANyl+HA3P3+ZY1+eQIMXjectPnUWuRnMm8CYQO5:mWgDBsKdHAWZM+VzNxnUpRnkRj
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 8 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 6 IoCs
-
Detects executables Discord URL observed in first stage droppers 6 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 6 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 6 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 6 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca.exe"C:\Users\Admin\AppData\Local\Temp\050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca.exe"C:\Users\Admin\AppData\Local\Temp\050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD546409aeee3041314b60d08c80d499064
SHA1f11a22170a942bac17ce0fc0c053b21e5ccffdcc
SHA2565bb930d9b600afe2bcc02e600f74a057dd0a37c01ef0225691fe100f8795482d
SHA512a5d20c0a25b0f8740568c88a1942cc08a16e59d2e1a0745556f59cf5bc6f1bdc9aeca1ca00cae9eccbb6b39f08fd55dfb35a11cd2ade3f347922d3fd8a126681
-
Filesize
19KB
MD5bd39f3eef855503a06b3fc6b9e075fc0
SHA170f818362379f1a31d6517de7db2c5771556ff5e
SHA256491a423e1b1846985c4b6459ebdde8240ddd204a1376a2fbe8f42d82df70b81d
SHA512c06fdadd01f19e10a6c9fe0ce598f5971932e4dd87e2d3770b95cc1f1f4b75c2cc66f490efe7faa3000efe6be418bde32780bcee83602aa55d2c728abef105b8
-
Filesize
19KB
MD52953838a54ab606c572bd47ad7cf324c
SHA1a22527c9c70ec0bdbcb57e4f51b7fc7ed0cecc89
SHA256f8cdb7d06d65d4e672ce96ab3545081b7d8ebfdac2744bfa8da84a67372e3e72
SHA5122ef3b9a4e2e039177df5138e46c6eaaac6d86ddcd9a044e8a9d8e80b7b720f637f953c30343df97b15ccd1cf6a7fae9a186048f2724fa468f6c7471ce2abc29a
-
Filesize
19KB
MD5bbdfd608ae077d50aaa74c8b84324506
SHA1dda0f071f677b81b0b2b94c03949efc11cf315e9
SHA256cc70503e740de2f69e36d110215ebf61ba8a5e8d9d72839821e4a0a538a1b731
SHA512d74392be1ffa90897e97aa965b5326800a76116f0e02fdae9ad35f20a457c8141179a23b9d3277355634c8ac7428e476653b55506185aee0dcade4582424cee2
-
Filesize
19KB
MD511b68c135cb2ab9889bbda626bb98195
SHA1f70ad2354c268f68a68386c814e8ba4dee53b8f0
SHA2563128860149fe24779de7ff34c8d4cc9eba332448855771141547b137ac294212
SHA51215180ab7474da1db05dce0a72cb80a73ca179578644716be52773d2ecf0e34acb5969fdc525299b174f0c3d85fbb0fb99f0bc1d3f81f7298f34047d5e4f50786
-
Filesize
4.1MB
MD558aeec23aa477acc489ca29fc8222e5e
SHA1fd189a7331274779548164e9a5c19f7c82bb287d
SHA256050c7bdef499a3aeecaa3bca43950f540c835b41a4b0d321f916e415ce564bca
SHA5124f6ce8c769d27fa6b1b2c640ba22c995eabcec9c530221678d60a356c80c43a9a8eb47bafb16d3dc18f9f4d352fc5cf334d6d0076ac87251ee121a446ffe2176
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
37.3MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
37.3MB
-
Filesize
8.9MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
436KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
436KB
-
Filesize
600KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
37.3MB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
652KB