Analysis
-
max time kernel
1488s -
max time network
1517s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/04/2025, 11:05
Behavioral task
behavioral1
Sample
Glorp.exe
Resource
win11-20250410-en
Behavioral task
behavioral2
Sample
Bot.pyc
Resource
win11-20250411-en
General
-
Target
Glorp.exe
-
Size
28.2MB
-
MD5
f7e236107f13e7ebb4171ecd6be3fc45
-
SHA1
69bee8d4328c771c62e039a4fac71cab6f7c1dea
-
SHA256
84f097b60f92ed039417665bd4eb9bd33eaf77890554e00adb4cd587de19b4ee
-
SHA512
afb310a936d3a95d504531d9b9253c0ca23b128fefe8be74bc94ee98e0aba2d1bdd239733bd4b87b1b926f899761e20f4d880815328b7cdd9c48c85feafdf553
-
SSDEEP
786432:dtC7QZ2YwUlJjXMb8vhPA5Mx7G92sqAD4ohONb:YQZ2mlBcghPymS9zqAL
Malware Config
Signatures
-
Loads dropped DLL 36 IoCs
pid Process 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe 4920 Glorp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 discord.com 2 discord.com -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4320 LocalBridge.exe 4320 LocalBridge.exe 4320 LocalBridge.exe 4320 LocalBridge.exe 4320 LocalBridge.exe 4320 LocalBridge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4920 Glorp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1440 wrote to memory of 4920 1440 Glorp.exe 80 PID 1440 wrote to memory of 4920 1440 Glorp.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Glorp.exe"C:\Users\Admin\AppData\Local\Temp\Glorp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\Glorp.exe"C:\Users\Admin\AppData\Local\Temp\Glorp.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3600
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
69KB
MD590a38a8271379a371a2a4c580e9cd97d
SHA13fde48214fd606114d7df72921cf66ef84bc04c5
SHA2563b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
SHA5123bde0b274f959d201f7820e3c01896c24e4909348c0bc748ade68610a13a4d1e980c50dab33466469cdd19eb90915b45593faab6c3609ae3f616951089de1fdc
-
Filesize
83KB
MD530f396f8411274f15ac85b14b7b3cd3d
SHA1d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA256cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
SHA5127d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
-
Filesize
175KB
MD5fcb71ce882f99ec085d5875e1228bdc1
SHA1763d9afa909c15fea8e016d321f32856ec722094
SHA25686f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
SHA5124a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6
-
Filesize
122KB
MD55377ab365c86bbcdd998580a79be28b4
SHA1b0a6342df76c4da5b1e28a036025e274be322b35
SHA2566c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
SHA51256f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
-
Filesize
251KB
MD57ae94f5a66986cbc1a2b3c65a8d617f3
SHA128abefb1df38514b9ffe562f82f8c77129ca3f7d
SHA256da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4
SHA512fbb599270066c43b5d3a4e965fb2203b085686479af157cd0bb0d29ed73248b6f6371c5158799f6d58b1f1199b82c01abe418e609ea98c71c37bb40f3226d8c5
-
Filesize
64KB
MD5a25bc2b21b555293554d7f611eaa75ea
SHA1a0dfd4fcfae5b94d4471357f60569b0c18b30c17
SHA25643acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
SHA512b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5
-
Filesize
156KB
MD59e94fac072a14ca9ed3f20292169e5b2
SHA11eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA256a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
SHA512b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
-
Filesize
34KB
MD541ee16713672e1bfc4543e6ae7588d72
SHA15ff680727935169e7bcb3991404c68fe6b2e4209
SHA2562feb0bf9658634fe8405f17c4573feb1c300e9345d7965738bedeb871a939e6b
SHA512cb407996a42bdf8bc47ce3f4c4485e27a4c862bf543410060e9f65d63bfba4c5a854a1f0601e9d8933c549e5459cb74ca27f3126c8cdbde0bdd2e803390ab942
-
Filesize
54KB
MD5737f46e8dac553427a823c5f0556961c
SHA130796737caec891a5707b71cf0ad1072469dd9de
SHA2562187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
SHA512f0f4b9045d5328335dc5d779f7ef5ce322eaa8126ec14a84be73edd47efb165f59903bff95eb0661eba291b4bb71474dd0b0686edc132f2fba305c47bb3d019f
-
Filesize
31KB
MD5e1c6ff3c48d1ca755fb8a2ba700243b2
SHA12f2d4c0f429b8a7144d65b179beab2d760396bfb
SHA2560a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
SHA51255bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1
-
Filesize
81KB
MD569801d1a0809c52db984602ca2653541
SHA10f6e77086f049a7c12880829de051dcbe3d66764
SHA25667aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
SHA5125fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
-
Filesize
174KB
MD590f080c53a2b7e23a5efd5fd3806f352
SHA1e3b339533bc906688b4d885bdc29626fbb9df2fe
SHA256fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
SHA5124b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a
-
Filesize
25KB
MD5d8c6d60ea44694015ba6123ff75bd38d
SHA1813deb632f3f3747fe39c5b8ef67bada91184f62
SHA2568ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
SHA512d3d408c79e291ed56ca3135b5043e555e53b70dff45964c8c8d7ffa92b27c6cdea1e717087b79159181f1258f9613fe6d05e3867d9c944f43a980b5bf27a75ab
-
Filesize
36KB
MD5827615eee937880862e2f26548b91e83
SHA1186346b816a9de1ba69e51042faf36f47d768b6c
SHA25673b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
SHA51245114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8
-
Filesize
54KB
MD57229278b22b09e6a529ddb47005277b5
SHA1a19b7f423e758507eb1de8168099a63a4460e328
SHA256ee325848cf143df67c63153bbafd9e72e33f0b57e025079875a2a7b0cb919792
SHA512beee7b5652a143383e91adb3583d7ec8c43152c482a513f760eaab949ce6ac78d8ffa3848a50dc53438bfaefa6172b008fca0b9997cfb31f4395d01f523d35ff
-
Filesize
259KB
MD58e4cded9429ec06c8f681ea0afa3bb93
SHA15ea5f8525ff4b49cb68712bbc94b9cef0d1e5784
SHA256cf70c494ec7087114a84412b8bd4e9ee7f60a2716df8d73252bf56b24a72fd9e
SHA5121b4b0c2f7785f6294441663b319fe2f0a5d5aae582552e4e7dd90e68dc6da430c53eb12a413a26a652d7ba79f4761436ad26d7cfc202e17bf99678ad0fc73e52
-
Filesize
49KB
MD5e37de249124daf6fd5164b7cfb8b7fe1
SHA1521ec4c8aadd4981a4a46adb2bf50877289af854
SHA2568a13b94b85d917d25cb8a6ea5d99cc82a39e9dd1618cb71e6a9219aadb76c5c3
SHA51206fc956e04ba01cef1fd3f3ee891f20975fdcaaa3e9b40bfa35d431aa1fb356e344b8bccc9991010d12c3e5c355ff72aa782a31c309dd1f04ac9680dbd750bf5
-
Filesize
36KB
MD5d0965116cbf816ec3dc7f960f47a63ba
SHA196ab646981fb9c902df80044bdaa7990d8362cd9
SHA2566c9338d5fe59ed8721209fd58c6caf7eb38f8695f1448914664e63e489d63958
SHA51296e6171159cc21d19c43c50c5b8c1d1410e152055f333da988fc854901ba9b06f91c6bbe9e528d63e5cc3c2aab19890c6df48178bd63477edc0c6a826865da7f
-
Filesize
1.3MB
MD5e828bd67a2b5c2bf2fc77572ba23beae
SHA174e033deac6bbdc50d8772a470e7c307f8f1d6eb
SHA2565c3e326107ee1f2be8a3acc8b9422a8279ac3bb7993f2df43ffc5a92f164dcfe
SHA512b7afda7942189c0f41b97f40f452a6087e707bbd88a1b3cd9dc6531d4f1de2d47bfc8e9684b19ec1b362596116ea9ea88955c8a8c5c29048d2e56aa1b40e14e1
-
Filesize
84KB
MD5d7193bea71087b94502c6b3a40120b04
SHA151aa3825a885a528356ba339f599c557e9973ec3
SHA256886375bc6f0ff2bbd1e8280f8f1cb29c93f94b8e25b5076043cd796654c3a193
SHA512c65cef39362a75814d40132f4f54f25f258c484dd011b12ae7051fa52865f025c960e4a3130c699b7eb1be375a3d2c3c3b733d6543338d7e40aad0488d305056
-
Filesize
5.0MB
MD5123ad0908c76ccba4789c084f7a6b8d0
SHA186de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA2564e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA51280fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
774KB
MD54ff168aaa6a1d68e7957175c8513f3a2
SHA1782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA2562e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
-
Filesize
45KB
MD54eed96bbb1c4b6d63f50c433e9c0a16a
SHA1cde34e8f1dac7f4e98d2b0aaf1186c6938de06c3
SHA256b521b7e3b6bed424a0719c36735bc4bf2bb8b0926370b31c221c604e81f8d78b
SHA5121cacb250d867fcbbc5224c3f66cb23a93f818bc1d0524cad6d1c52295d243af10f454fde13fa58671d3ee62281a2a3f71a69f28b08fd942fcedba3c9b09a774a
-
Filesize
197KB
MD58c1f876831395d146e3bcadcea2486dd
SHA182cbfb59f0581a0554d6a5061e1f82e6b46a3473
SHA256d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
SHA51273067bb8dcc44cd52551a48400bd8e721268dd44f9884ebb603452ece9c7bd276d40b7cbca4f10223f27b8ccdcd1d2ec298a1c767a691859aea10056c108a730
-
Filesize
66KB
MD55eace36402143b0205635818363d8e57
SHA1ae7b03251a0bac083dec3b1802b5ca9c10132b4c
SHA25625a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
SHA5127cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4
-
Filesize
6.6MB
MD5166cc2f997cba5fc011820e6b46e8ea7
SHA1d6179213afea084f02566ea190202c752286ca1f
SHA256c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
SHA51249d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
-
Filesize
30KB
MD57c14c7bc02e47d5c8158383cb7e14124
SHA15ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA25600bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
SHA512af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
-
C:\Users\Admin\AppData\Local\Temp\_MEI14402\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI14402\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Filesize1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
1KB
MD54ce7501f6608f6ce4011d627979e1ae4
SHA178363672264d9cd3f72d5c1d3665e1657b1a5071
SHA25637fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1
-
Filesize
1.1MB
MD5a8ed52a66731e78b89d3c6c6889c485d
SHA1781e5275695ace4a5c3ad4f2874b5e375b521638
SHA256bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
SHA5121c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017
-
Filesize
54KB
MD5863a566f7c2a76b8a23ac30e04c0dacf
SHA1df75c0d04810f3027a5e182ead3efbaf7616c07c
SHA256de569177bec7668c01a82b8be7f56dd25f13fe296432715b1035b57153453bbc
SHA512d9135ca93a56642ad80b4f04c1ee1647207cf9cdc19943696d7a710f1ca680435a931f22829078a0c85766dbae2e9e3c768a7c681d92fca8d65cf32d53558152
-
Filesize
95KB
MD535fa0191828509c2bb02684f36ddc796
SHA168faf30484482e465106c449abeafa5741f16541
SHA25619d8e8f4293b3abacb4db9e68cf402b9a24a260faac7df7ec373d7ddc6dd7ec4
SHA512e468f4fb5b8428add59dbaafcee5f536c9f24771b9fb2b7754445af2925ef286bbe283951cc1c1e2a5ce33bd311b51a8a7d44e06be9e5663be4d19fcacd51115