glupteba | e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2

General

Target

0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
Size

5.0MB
MD5

0ae0633ca64e5cf205aef2d10a7aa6fa
SHA1

101654c4610e8c784811f36179cd6de9d00f01c8
SHA256

e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2
SHA512

e19ea29d395ba3022806d395431afc42559e94e5135daa1e67ba790c19979fb97da8d4408bd3edec9932fd36d8387cfabdce22e0d6dd1396acc10be4a3fe7576
SSDEEP

98304:SeDb2l0wP3lTII0pPv77cFLbLZkJNjmz7AVzIT:Xf22wP31IfpX77WL5AsMzIT

Score

10^/10

glupteba dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 14 IoCs

resource	yara_rule
behavioral1/memory/328-2-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/328-3-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/328-5-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/328-7-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/328-9-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral1/memory/328-8-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/2876-22-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/2876-23-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/2876-25-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/2876-35-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/852-37-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/852-38-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/852-40-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral1/memory/852-41-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1824	netsh.exe

C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe"
1⤵
PID:328
- C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe"
  2⤵
  PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:1464
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1824
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /6-JaffaCakes118
    3⤵
    PID:852

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20241002132731.log C:\Windows\Logs\CBS\CbsPersist_20241002132731.cab
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\rss\csrss.exe

Filesize
5.0MB

MD5
0ae0633ca64e5cf205aef2d10a7aa6fa

SHA1
101654c4610e8c784811f36179cd6de9d00f01c8

SHA256
e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2

SHA512
e19ea29d395ba3022806d395431afc42559e94e5135daa1e67ba790c19979fb97da8d4408bd3edec9932fd36d8387cfabdce22e0d6dd1396acc10be4a3fe7576

Download Submit
memory/328-1-0x00000000017E0000-0x0000000001CAA000-memory.dmp

Filesize
4.8MB

Download
memory/328-2-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/328-3-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/328-4-0x00000000017E0000-0x0000000001CAA000-memory.dmp

Filesize
4.8MB

Download
memory/328-5-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/328-7-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/328-9-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/328-8-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/328-0-0x00000000017E0000-0x0000000001CAA000-memory.dmp

Filesize
4.8MB

Download
memory/852-36-0x0000000001790000-0x0000000001C5A000-memory.dmp

Filesize
4.8MB

Download
memory/852-37-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/852-38-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/852-40-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/852-41-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2876-23-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2876-25-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2876-22-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2876-35-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2876-21-0x0000000001870000-0x0000000001D3A000-memory.dmp

Filesize
4.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads