glupteba | ac10e43cbfc02ecb3278104fd75c5ec8817100682a711318c473fd66287e23e1

General

Target

9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
Size

5.0MB
MD5

9b3acfbcc7329bb4076590bcf06405ea
SHA1

080381c640febaac9b4fa902f6c890efe4d27f15
SHA256

ac10e43cbfc02ecb3278104fd75c5ec8817100682a711318c473fd66287e23e1
SHA512

7d0378f6203a70c5215bbc8a7d334256224a026ad1a32b796f866d08efb9c5e9df0ac3039bcbe18e53c07280e62a108a7188c511c4377a241ef2efd071f0a2f9
SSDEEP

98304:OOmWCUAtacMcP75xJIaZKcrVjYjJ5xxg57Vx9YvXR6PNjTAz8HASWOK1:O3WWDMcP75xJIVJi7Vxu0PNQz8gfb

Score

10^/10

glupteba dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 13 IoCs

resource	yara_rule
behavioral2/memory/3320-2-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral2/memory/3320-3-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/3320-5-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral2/memory/3320-4-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1376-8-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1376-14-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-16-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-18-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-19-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-20-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-21-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-23-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba
behavioral2/memory/1932-24-0x0000000000400000-0x000000000110C000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2872	netsh.exe
1516	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3320	9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
- C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"
  2⤵
  PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
    3⤵
    PID:3396
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2120
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1516
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /6-JaffaCakes118
    3⤵
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe

Filesize
5.0MB

MD5
9b3acfbcc7329bb4076590bcf06405ea

SHA1
080381c640febaac9b4fa902f6c890efe4d27f15

SHA256
ac10e43cbfc02ecb3278104fd75c5ec8817100682a711318c473fd66287e23e1

SHA512
7d0378f6203a70c5215bbc8a7d334256224a026ad1a32b796f866d08efb9c5e9df0ac3039bcbe18e53c07280e62a108a7188c511c4377a241ef2efd071f0a2f9

Download Submit
memory/1376-7-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1376-14-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1376-8-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-20-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-16-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-18-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-19-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-21-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-23-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/1932-24-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/3320-4-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/3320-5-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/3320-3-0x0000000000400000-0x000000000110C000-memory.dmp

Filesize
13.0MB

Download
memory/3320-2-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/3320-1-0x00000000035A0000-0x0000000003A6D000-memory.dmp

Filesize
4.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads