glupteba | 1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e

Analysis

max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e.exe
Size

4.4MB
MD5

9b09bb786f415c5fee6f6f34b23cf28e
SHA1

00d6cd58e2cd932151c18b5c285d8a7e7a6d4aa2
SHA256

1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e
SHA512

8af5ca72e77c759bdf61b1ed58aa6f61f0c406c4075e6e3f3ff6587dfe65c59b25565969be24a6a6fbf7aaadbef8c88076b74d6fa9888dd38bdcedd6f263e7ba
SSDEEP

98304:VTob8QH57XzQ0W/F92bARPxCzl1XTS8Li1EoYYRQN36V4FJYzLr/f+MXVmd:2bBlXsj/F9IKcR1EeYRw6CbYzGMFmd

Score

10^/10

glupteba metasploit backdoor discovery dropper loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Glupteba family
glupteba

Glupteba payload 4 IoCs

resource	yara_rule
behavioral2/memory/4680-2-0x0000000002F60000-0x0000000003886000-memory.dmp	family_glupteba
behavioral2/memory/4680-3-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/4680-5-0x0000000002F60000-0x0000000003886000-memory.dmp	family_glupteba
behavioral2/memory/4680-4-0x0000000000400000-0x00000000027DC000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	4680	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fadab489997035f530de69ec7b6bd026b9ec75f7d86d477e68ed38eb661a11e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 216
  2⤵
  - Program crash
  PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4680 -ip 4680
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-1-0x0000000002B10000-0x0000000002F5C000-memory.dmp

Filesize
4.3MB

Download
memory/4680-2-0x0000000002F60000-0x0000000003886000-memory.dmp

Filesize
9.1MB

Download
memory/4680-3-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/4680-5-0x0000000002F60000-0x0000000003886000-memory.dmp

Filesize
9.1MB

Download
memory/4680-4-0x0000000000400000-0x00000000027DC000-memory.dmp

Filesize
35.9MB

Download