General
-
Target
Glupteba.exe
-
Size
3.8MB
-
Sample
240722-wavf4sygmf
-
MD5
17121a4228da9d1d811e853b1b96cd0e
-
SHA1
61d16b12fc84d530373a9892d441d08275884d8a
-
SHA256
d45718639cc2ea44fa94d80ad765c251755eda022cd65d0cf3b56fa2c2325c21
-
SHA512
a3dbbbde6879abfb1820610d898e7054f01949a508e061ebfcdaac916862e2306d5df226bda6c2bd37a27667c25c7ebf1b7dba3cb067e4bdf1aaae5c02129c87
-
SSDEEP
98304:kXUZKpu2i2Rb665u8FrbO3MISyl32aKxgBuwrkAToXvGgn/YYr:8QKpRWMu8HaHl32hCBbkAToeg
Static task
static1
Behavioral task
behavioral1
Sample
Glupteba.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Glupteba.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
Glupteba.exe
-
Size
3.8MB
-
MD5
17121a4228da9d1d811e853b1b96cd0e
-
SHA1
61d16b12fc84d530373a9892d441d08275884d8a
-
SHA256
d45718639cc2ea44fa94d80ad765c251755eda022cd65d0cf3b56fa2c2325c21
-
SHA512
a3dbbbde6879abfb1820610d898e7054f01949a508e061ebfcdaac916862e2306d5df226bda6c2bd37a27667c25c7ebf1b7dba3cb067e4bdf1aaae5c02129c87
-
SSDEEP
98304:kXUZKpu2i2Rb665u8FrbO3MISyl32aKxgBuwrkAToXvGgn/YYr:8QKpRWMu8HaHl32hCBbkAToeg
-
Glupteba payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
3Netsh Helper DLL
1Image File Execution Options Injection
1Component Object Model Hijacking
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
3Netsh Helper DLL
1Image File Execution Options Injection
1Component Object Model Hijacking
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Disable or Modify System Firewall
1Modify Registry
4