glupteba | 81b8d673c51e5f98a4690c11f4f4f156349b2ab850733cbac4119c7c6ec3d804

General

Target

40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe
Size

4.1MB
MD5

256506e20fe6bddbe08403debd4c39cc
SHA1

40d22787e79f76e54bfeb359822a4b3ad8e6bef6
SHA256

81b8d673c51e5f98a4690c11f4f4f156349b2ab850733cbac4119c7c6ec3d804
SHA512

0a626cc31e90a755706953fbffc6f9e4cbdb1a001c2688589594094f848dea5543b0b7fcbf55e983861f477f83e13c87bd165c5085514690f700b239f7543669
SSDEEP

98304:ozPUPTTQjdPp+CX8gA6IfphzteABldSZy:oLYTTQBPZ+fpbRky

Score

10^/10

glupteba discovery dropper evasion loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Glupteba family
glupteba

Glupteba payload 13 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3192-2-0x0000000002E80000-0x00000000036F7000-memory.dmp	family_glupteba
behavioral2/memory/3192-3-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/3192-4-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/3192-5-0x0000000002E80000-0x00000000036F7000-memory.dmp	family_glupteba
behavioral2/memory/4560-8-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/4560-14-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-21-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-22-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-23-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-24-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-25-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-26-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba
behavioral2/memory/536-27-0x0000000000400000-0x0000000000C91000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1680 netsh.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

392 schtasks.exe
4504 schtasks.exe

pid	process
1680	netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe

pid	process
392	schtasks.exe
4504	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe
"C:\Users\Admin\AppData\Local\Temp\40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3192
- C:\Users\Admin\AppData\Local\Temp\40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe
  "C:\Users\Admin\AppData\Local\Temp\40d22787e79f76e54bfeb359822a4b3ad8e6bef6.exe"
  2⤵
  PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2960
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1680
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:536
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:392
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:208
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:1932
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
256506e20fe6bddbe08403debd4c39cc

SHA1
40d22787e79f76e54bfeb359822a4b3ad8e6bef6

SHA256
81b8d673c51e5f98a4690c11f4f4f156349b2ab850733cbac4119c7c6ec3d804

SHA512
0a626cc31e90a755706953fbffc6f9e4cbdb1a001c2688589594094f848dea5543b0b7fcbf55e983861f477f83e13c87bd165c5085514690f700b239f7543669

Download Submit
memory/536-29-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-30-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-24-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-23-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-33-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-32-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-31-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-27-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-25-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-22-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-34-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-28-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-21-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/536-26-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/3192-1-0x0000000002A90000-0x0000000002E7F000-memory.dmp

Filesize
3.9MB

Download
memory/3192-5-0x0000000002E80000-0x00000000036F7000-memory.dmp

Filesize
8.5MB

Download
memory/3192-4-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/3192-2-0x0000000002E80000-0x00000000036F7000-memory.dmp

Filesize
8.5MB

Download
memory/3192-3-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/4560-14-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/4560-8-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/4560-7-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads