glupteba | e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2

General

Target

0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
Size

5.0MB
MD5

0ae0633ca64e5cf205aef2d10a7aa6fa
SHA1

101654c4610e8c784811f36179cd6de9d00f01c8
SHA256

e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2
SHA512

e19ea29d395ba3022806d395431afc42559e94e5135daa1e67ba790c19979fb97da8d4408bd3edec9932fd36d8387cfabdce22e0d6dd1396acc10be4a3fe7576
SSDEEP

98304:SeDb2l0wP3lTII0pPv77cFLbLZkJNjmz7AVzIT:Xf22wP31IfpX77WL5AsMzIT

Score

10^/10

glupteba discovery dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 10 IoCs

resource	yara_rule
behavioral2/memory/3036-2-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral2/memory/3036-4-0x0000000000400000-0x0000000000AE9000-memory.dmp	family_glupteba
behavioral2/memory/3036-3-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2148-7-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2148-8-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2148-9-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2148-10-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2148-16-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2624-18-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba
behavioral2/memory/2624-21-0x0000000000400000-0x0000000001105000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3224	netsh.exe
3484	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3036
- C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ae0633ca64e5cf205aef2d10a7aa6fa_JaffaCakes118.exe"
  2⤵
  PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:3272
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
    3⤵
    PID:1144
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3484
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /6-JaffaCakes118
    3⤵
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe

Filesize
5.0MB

MD5
0ae0633ca64e5cf205aef2d10a7aa6fa

SHA1
101654c4610e8c784811f36179cd6de9d00f01c8

SHA256
e98a00d76c5b7c8531ec6963c3fd3a60a682fa28c588389ae9c4064479f8aca2

SHA512
e19ea29d395ba3022806d395431afc42559e94e5135daa1e67ba790c19979fb97da8d4408bd3edec9932fd36d8387cfabdce22e0d6dd1396acc10be4a3fe7576

Download Submit
memory/2148-8-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2148-6-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2148-7-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2148-9-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2148-10-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2148-16-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2624-18-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/2624-21-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/3036-4-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download
memory/3036-3-0x0000000000400000-0x0000000001105000-memory.dmp

Filesize
13.0MB

Download
memory/3036-1-0x0000000001CE0000-0x00000000021B6000-memory.dmp

Filesize
4.8MB

Download
memory/3036-2-0x0000000000400000-0x0000000000AE9000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads