glupteba | c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8

General

Target

d055aa1d2702cf0186ac8dc1c2aea170_JaffaCakes118.exe
Size

5.0MB
MD5

d055aa1d2702cf0186ac8dc1c2aea170
SHA1

01671d78a8ff90a9b34d162fb4ab04c6716a950c
SHA256

c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8
SHA512

21399ead14206296f035177bc9e564099006dd526430b45c6226abf0c46d1c5fac363f4c0af7d1bd2eb968b8dae4eb68250971a5d99901ab6e12a8bfc53acabf
SSDEEP

98304:NnbMiCEK1vZpAWCfSdr1bZwbFizPkgFpM4xAIkSksjJ22OweySzHQrDzERAF:NnJ7K1vZmXf+rLwbobFptky92PDe3NF

Score

10^/10

glupteba dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3056-2-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/3056-5-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/3056-3-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2724-19-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2724-29-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-31-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-33-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-34-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-36-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-37-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-38-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2996-40-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
2900	netsh.exe

C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170_JaffaCakes118.exe"
1⤵
PID:3056
- C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170_JaffaCakes118.exe"
  2⤵
  PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:1788
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2900
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /6-JaffaCakes118
    3⤵
    PID:2996

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240906194946.log C:\Windows\Logs\CBS\CbsPersist_20240906194946.cab
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\rss\csrss.exe

Filesize
5.0MB

MD5
d055aa1d2702cf0186ac8dc1c2aea170

SHA1
01671d78a8ff90a9b34d162fb4ab04c6716a950c

SHA256
c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8

SHA512
21399ead14206296f035177bc9e564099006dd526430b45c6226abf0c46d1c5fac363f4c0af7d1bd2eb968b8dae4eb68250971a5d99901ab6e12a8bfc53acabf

Download Submit
memory/2724-17-0x0000000001880000-0x0000000001D49000-memory.dmp

Filesize
4.8MB

Download
memory/2724-29-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2724-19-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2724-18-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-31-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-33-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-40-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-38-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-37-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-36-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2996-30-0x00000000017D0000-0x0000000001C99000-memory.dmp

Filesize
4.8MB

Download
memory/2996-34-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/3056-2-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/3056-0-0x0000000001760000-0x0000000001C29000-memory.dmp

Filesize
4.8MB

Download
memory/3056-1-0x0000000001760000-0x0000000001C29000-memory.dmp

Filesize
4.8MB

Download
memory/3056-3-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/3056-5-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/3056-4-0x0000000001760000-0x0000000001C29000-memory.dmp

Filesize
4.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads