Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 10:02

General

  • Target

    2024-10-03_7d31b20c88ee1938102f889b63f4105b_poet-rat_snatch.exe

  • Size

    9.1MB

  • MD5

    7d31b20c88ee1938102f889b63f4105b

  • SHA1

    1bbad6d8ee432927a6ae5e300a9d5a70bbe03fad

  • SHA256

    f007f850a708b041bf4b8d6d97c59a004b57232d3642d9292cb349abb183dc5f

  • SHA512

    d854b299772ab46cd677e6814a84711e8c2e447963e61a31cfe188995c7fd84f756ab0fec0b298e314a7f139e790c56bd5418a98737c84978cbc530e4c457789

  • SSDEEP

    98304:GHxMZDJ1TRpxYVX9u2IazANfQhZytTD5iqE:sxEvYjVzANIhwN

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-03_7d31b20c88ee1938102f889b63f4105b_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-03_7d31b20c88ee1938102f889b63f4105b_poet-rat_snatch.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4560
    • C:\Users\Admin\AppData\Local\Temp\2024-10-03_7d31b20c88ee1938102f889b63f4105b_poet-rat_snatch.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-03_7d31b20c88ee1938102f889b63f4105b_poet-rat_snatch.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3784
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4300
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1168
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2904
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4432
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4884
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3508
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3988
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjph0jtr.gnu.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      59dee77bd981d43ff929ea0062811eaa

      SHA1

      51c4ec0b05ebc42aeab02d410d9c3834f4a2346b

      SHA256

      800a2732baa5a2eb57cce166ff980ac6f9fbdf9952a3c7bc99f33db59cb75190

      SHA512

      7381c7f64b5b31ac5047201c99f271dabd0c5bb2d6a7a63813128246b6f0930d96b7dafb2adf189d3bccde1a6679501d52d9ae3e568b177f459437c21364291d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      47576fd652717c8f0e90c561c27b8404

      SHA1

      9725d3f09a320b0e9bc7615f6fd1af700edfc094

      SHA256

      85344a75596da7f949f35b4417237ab799586ee30bd8c5d5c13d2ace7a2ccb74

      SHA512

      0f74e78f5034ded1aff0b52f5771ffa4a18ed1642a72f49c06e9010dceb70741ad2eb67ab6f4f287e9c77f145c89bdea3dfc827f21f5b8732d499ae6128b1809

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      a17e01068265dba00634d755fcc9f837

      SHA1

      89ebd7ede8d25c388158c1b794914ae0baa7fd53

      SHA256

      fea10f4d1fddca188a24f1246f0626e5977429fddbc4f5cf5274bf347e838462

      SHA512

      871a3e51ed3faec58581238dc1d422fa3e153aabf48ebebc8a9728352691444103387c9c4f847f211b3a2a6be4ee57298821151c56abddc874efe968c465d5dd

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      8b4e1e3ed500f6ab5e99b3b76d9d5eb7

      SHA1

      1b5fe4f847fcec890670a416e525460b30ff759d

      SHA256

      a3ddc6c1d3e3fec326d7cc6166bde25bc351646af84da2ec7f56f5d3c001a176

      SHA512

      ebaec8749b51bff958182283dc5907eb1d14545bfbce5e3b3401e79861df7cfc667e9e3fe5c301012d1ef6382e74d007fc082d1209b55475f191e700e2fba115

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      5629691014ff8c26ae15606aa6162852

      SHA1

      c66d3c8cf13cc3f569614f1d68d644ab00f1e159

      SHA256

      4b2747daeb230016890a5fd572525c42a617dac260a49ed8c588d3219f348ead

      SHA512

      c71b6dc2e839cd22fc8827fd6ac8751f9680404813eec1cc28e0acc51e062fb4ffca073fe8ff38086688ab471cfc5e22c02b84d1aeac2e78aa0ab6c6354d4edf

    • C:\Windows\rss\csrss.exe

      Filesize

      9.1MB

      MD5

      7d31b20c88ee1938102f889b63f4105b

      SHA1

      1bbad6d8ee432927a6ae5e300a9d5a70bbe03fad

      SHA256

      f007f850a708b041bf4b8d6d97c59a004b57232d3642d9292cb349abb183dc5f

      SHA512

      d854b299772ab46cd677e6814a84711e8c2e447963e61a31cfe188995c7fd84f756ab0fec0b298e314a7f139e790c56bd5418a98737c84978cbc530e4c457789

    • memory/1168-91-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/1168-89-0x0000000005FD0000-0x0000000006324000-memory.dmp

      Filesize

      3.3MB

    • memory/1168-92-0x0000000070740000-0x0000000070A94000-memory.dmp

      Filesize

      3.3MB

    • memory/2184-113-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/2184-114-0x0000000070740000-0x0000000070A94000-memory.dmp

      Filesize

      3.3MB

    • memory/3508-195-0x0000000070A00000-0x0000000070D54000-memory.dmp

      Filesize

      3.3MB

    • memory/3508-192-0x0000000005C40000-0x0000000005F94000-memory.dmp

      Filesize

      3.3MB

    • memory/3508-194-0x0000000070440000-0x000000007048C000-memory.dmp

      Filesize

      304KB

    • memory/4000-61-0x00000000056A0000-0x00000000059F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4000-76-0x00000000071D0000-0x00000000071E4000-memory.dmp

      Filesize

      80KB

    • memory/4000-75-0x0000000007180000-0x0000000007191000-memory.dmp

      Filesize

      68KB

    • memory/4000-74-0x0000000006E50000-0x0000000006EF3000-memory.dmp

      Filesize

      652KB

    • memory/4000-64-0x0000000070CE0000-0x0000000071034000-memory.dmp

      Filesize

      3.3MB

    • memory/4000-63-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/4000-62-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

      Filesize

      304KB

    • memory/4560-25-0x00000000704C0000-0x000000007050C000-memory.dmp

      Filesize

      304KB

    • memory/4560-18-0x0000000005E30000-0x0000000005E4E000-memory.dmp

      Filesize

      120KB

    • memory/4560-43-0x0000000007600000-0x0000000007696000-memory.dmp

      Filesize

      600KB

    • memory/4560-44-0x0000000007500000-0x0000000007511000-memory.dmp

      Filesize

      68KB

    • memory/4560-45-0x0000000007540000-0x000000000754E000-memory.dmp

      Filesize

      56KB

    • memory/4560-46-0x0000000007560000-0x0000000007574000-memory.dmp

      Filesize

      80KB

    • memory/4560-47-0x00000000075A0000-0x00000000075BA000-memory.dmp

      Filesize

      104KB

    • memory/4560-48-0x0000000007590000-0x0000000007598000-memory.dmp

      Filesize

      32KB

    • memory/4560-51-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-41-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-40-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-39-0x0000000007400000-0x00000000074A3000-memory.dmp

      Filesize

      652KB

    • memory/4560-38-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-37-0x00000000073E0000-0x00000000073FE000-memory.dmp

      Filesize

      120KB

    • memory/4560-27-0x0000000070C20000-0x0000000070F74000-memory.dmp

      Filesize

      3.3MB

    • memory/4560-24-0x00000000073A0000-0x00000000073D2000-memory.dmp

      Filesize

      200KB

    • memory/4560-0-0x000000007462E000-0x000000007462F000-memory.dmp

      Filesize

      4KB

    • memory/4560-26-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-23-0x00000000071E0000-0x00000000071FA000-memory.dmp

      Filesize

      104KB

    • memory/4560-22-0x0000000007840000-0x0000000007EBA000-memory.dmp

      Filesize

      6.5MB

    • memory/4560-21-0x0000000006F40000-0x0000000006FB6000-memory.dmp

      Filesize

      472KB

    • memory/4560-20-0x0000000006370000-0x00000000063B4000-memory.dmp

      Filesize

      272KB

    • memory/4560-19-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

      Filesize

      304KB

    • memory/4560-42-0x00000000074F0000-0x00000000074FA000-memory.dmp

      Filesize

      40KB

    • memory/4560-17-0x0000000005890000-0x0000000005BE4000-memory.dmp

      Filesize

      3.3MB

    • memory/4560-1-0x00000000024E0000-0x0000000002516000-memory.dmp

      Filesize

      216KB

    • memory/4560-6-0x0000000004FB0000-0x0000000005016000-memory.dmp

      Filesize

      408KB

    • memory/4560-2-0x0000000005160000-0x0000000005788000-memory.dmp

      Filesize

      6.2MB

    • memory/4560-3-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4560-4-0x0000000004D30000-0x0000000004D52000-memory.dmp

      Filesize

      136KB

    • memory/4560-5-0x0000000004ED0000-0x0000000004F36000-memory.dmp

      Filesize

      408KB

    • memory/4560-12-0x0000000074620000-0x0000000074DD0000-memory.dmp

      Filesize

      7.7MB

    • memory/4884-179-0x0000000007540000-0x00000000075E3000-memory.dmp

      Filesize

      652KB

    • memory/4884-161-0x0000000005C80000-0x0000000005FD4000-memory.dmp

      Filesize

      3.3MB

    • memory/4884-180-0x00000000060F0000-0x0000000006101000-memory.dmp

      Filesize

      68KB

    • memory/4884-167-0x0000000006380000-0x00000000063CC000-memory.dmp

      Filesize

      304KB

    • memory/4884-168-0x0000000070440000-0x000000007048C000-memory.dmp

      Filesize

      304KB

    • memory/4884-169-0x0000000070BD0000-0x0000000070F24000-memory.dmp

      Filesize

      3.3MB

    • memory/4884-181-0x0000000006130000-0x0000000006144000-memory.dmp

      Filesize

      80KB

    • memory/4964-140-0x00000000060A0000-0x00000000060EC000-memory.dmp

      Filesize

      304KB

    • memory/4964-154-0x0000000005E60000-0x0000000005E74000-memory.dmp

      Filesize

      80KB

    • memory/4964-142-0x0000000070CC0000-0x0000000071014000-memory.dmp

      Filesize

      3.3MB

    • memory/4964-152-0x0000000007260000-0x0000000007303000-memory.dmp

      Filesize

      652KB

    • memory/4964-141-0x0000000070520000-0x000000007056C000-memory.dmp

      Filesize

      304KB

    • memory/4964-153-0x0000000005E10000-0x0000000005E21000-memory.dmp

      Filesize

      68KB

    • memory/4964-134-0x0000000005970000-0x0000000005CC4000-memory.dmp

      Filesize

      3.3MB