glupteba | 6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a

General

Target

c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
Size

3.9MB
MD5

c40e14338592240c54c328318963b3bb
SHA1

0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d
SHA256

6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
SHA512

292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95
SSDEEP

98304:ZpeqFp3bVhsj5EGj2QV/yQtWP7EWnJc4MhN9VmmpW/Ib:ZpeqFtbVCj+Gp/yQKnJcT/pe

Score

10^/10

glupteba discovery dropper evasion loader persistence privilege_escalation

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

resource	yara_rule
behavioral2/memory/5020-2-0x0000000002B10000-0x0000000003206000-memory.dmp	family_glupteba
behavioral2/memory/5020-3-0x0000000000400000-0x0000000000B10000-memory.dmp	family_glupteba
behavioral2/memory/5020-5-0x0000000000400000-0x0000000000B10000-memory.dmp	family_glupteba
behavioral2/memory/5020-6-0x0000000002B10000-0x0000000003206000-memory.dmp	family_glupteba
behavioral2/memory/1860-9-0x0000000000400000-0x0000000000B10000-memory.dmp	family_glupteba
behavioral2/memory/1860-15-0x0000000000400000-0x0000000000B10000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1308	netsh.exe
1936	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
3120	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SummerFirefly = "\"C:\\Windows\\rss\\csrss.exe\""	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
File created	C:\Windows\rss\csrss.exe	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5020	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
5020	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
Token: SeImpersonatePrivilege	5020	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 948	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	106
PID 1860 wrote to memory of 948	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	106
PID 948 wrote to memory of 1308	948	cmd.exe	108
PID 948 wrote to memory of 1308	948	cmd.exe	108
PID 1860 wrote to memory of 896	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	109
PID 1860 wrote to memory of 896	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	109
PID 896 wrote to memory of 1936	896	cmd.exe	111
PID 896 wrote to memory of 1936	896	cmd.exe	111
PID 1860 wrote to memory of 3120	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	112
PID 1860 wrote to memory of 3120	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	112
PID 1860 wrote to memory of 3120	1860	c40e14338592240c54c328318963b3bb_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c40e14338592240c54c328318963b3bb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
- C:\Users\Admin\AppData\Local\Temp\c40e14338592240c54c328318963b3bb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c40e14338592240c54c328318963b3bb_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\52d280c9aa29\52d280c9aa29\52d280c9aa29.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\52d280c9aa29\52d280c9aa29\52d280c9aa29.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1936
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe

Filesize
3.9MB

MD5
c40e14338592240c54c328318963b3bb

SHA1
0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d

SHA256
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a

SHA512
292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95

Download Submit
memory/1860-8-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/1860-9-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/1860-15-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/5020-1-0x0000000002760000-0x0000000002B0B000-memory.dmp

Filesize
3.7MB

Download
memory/5020-2-0x0000000002B10000-0x0000000003206000-memory.dmp

Filesize
7.0MB

Download
memory/5020-3-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/5020-5-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/5020-6-0x0000000002B10000-0x0000000003206000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads