glupteba | c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8

General

Target

d055aa1d2702cf0186ac8dc1c2aea170N.exe
Size

5.0MB
MD5

d055aa1d2702cf0186ac8dc1c2aea170
SHA1

01671d78a8ff90a9b34d162fb4ab04c6716a950c
SHA256

c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8
SHA512

21399ead14206296f035177bc9e564099006dd526430b45c6226abf0c46d1c5fac363f4c0af7d1bd2eb968b8dae4eb68250971a5d99901ab6e12a8bfc53acabf
SSDEEP

98304:NnbMiCEK1vZpAWCfSdr1bZwbFizPkgFpM4xAIkSksjJ22OweySzHQrDzERAF:NnJ7K1vZmXf+rLwbobFptky92PDe3NF

Score

10^/10

glupteba dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 13 IoCs

resource	yara_rule
behavioral1/memory/2748-1-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/2748-2-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2748-3-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2748-5-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/2560-18-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2560-19-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/2560-29-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-31-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-32-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-33-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-34-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-36-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba
behavioral1/memory/1956-37-0x0000000000400000-0x0000000001108000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1960	netsh.exe

C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170N.exe
"C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170N.exe"
1⤵
PID:2748
- C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170N.exe
  "C:\Users\Admin\AppData\Local\Temp\d055aa1d2702cf0186ac8dc1c2aea170N.exe"
  2⤵
  PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:3044
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1960
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    PID:1956

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240911021740.log C:\Windows\Logs\CBS\CbsPersist_20240911021740.cab
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\rss\csrss.exe

Filesize
5.0MB

MD5
d055aa1d2702cf0186ac8dc1c2aea170

SHA1
01671d78a8ff90a9b34d162fb4ab04c6716a950c

SHA256
c0e45b39bf808cc4741933404772f7a2f90dfc453b17b5d30fc71f2f7373e7c8

SHA512
21399ead14206296f035177bc9e564099006dd526430b45c6226abf0c46d1c5fac363f4c0af7d1bd2eb968b8dae4eb68250971a5d99901ab6e12a8bfc53acabf

Download Submit
memory/1956-37-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-36-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-34-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-33-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-32-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-31-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/1956-30-0x0000000001940000-0x0000000001E09000-memory.dmp

Filesize
4.8MB

Download
memory/2560-19-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2560-29-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2560-18-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2560-17-0x0000000001810000-0x0000000001CD9000-memory.dmp

Filesize
4.8MB

Download
memory/2748-0-0x0000000001800000-0x0000000001CC9000-memory.dmp

Filesize
4.8MB

Download
memory/2748-5-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/2748-3-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2748-4-0x0000000001800000-0x0000000001CC9000-memory.dmp

Filesize
4.8MB

Download
memory/2748-2-0x0000000000400000-0x0000000001108000-memory.dmp

Filesize
13.0MB

Download
memory/2748-1-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads