Analysis
- max time kernel
13s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 21:55
General
- Target tmpqe4_b5tq.exe
- Size 4.2MB
- Sample260522-1synpsfs9p
- SHA256 bbfa3271bc782b462405c2fc4eebf0906b40005209a0c0a20214996ed87c1444
Malware Config
Signatures
- Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 11 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1824 -ip 18241⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
__PSScriptPolicyTest_hifm5adf.hng.ps1
injector.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
memory/928-76-0x00000000056B0000-0x0000000005A04000-memory.dmp
memory/928-86-0x0000000070650000-0x00000000709A4000-memory.dmp
memory/928-85-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/1172-267-0x0000000007BB0000-0x0000000007BC4000-memory.dmp
memory/1172-255-0x0000000070590000-0x00000000708E4000-memory.dmp
memory/1172-254-0x000000006FF10000-0x000000006FF5C000-memory.dmp
memory/1172-263-0x0000000005E70000-0x0000000005E81000-memory.dmp
memory/1332-49-0x0000000003440000-0x000000000383B000-memory.dmp
memory/1332-1-0x0000000003440000-0x000000000383B000-memory.dmp
memory/1332-2-0x0000000004FE0000-0x00000000058CB000-memory.dmp
memory/1332-51-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/1332-50-0x0000000004FE0000-0x00000000058CB000-memory.dmp
memory/1824-251-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/1824-244-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/2132-208-0x0000000070650000-0x00000000709A4000-memory.dmp
memory/2132-207-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/2140-34-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2140-20-0x0000000007D20000-0x0000000007D96000-memory.dmp
memory/2140-44-0x0000000008220000-0x000000000823A000-memory.dmp
memory/2140-43-0x0000000008130000-0x0000000008144000-memory.dmp
memory/2140-42-0x0000000008120000-0x000000000812E000-memory.dmp
memory/2140-26-0x0000000070280000-0x00000000705D4000-memory.dmp
memory/2140-3-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2140-4-0x0000000005440000-0x0000000005476000-memory.dmp
memory/2140-5-0x0000000005BB0000-0x00000000061D8000-memory.dmp
memory/2140-6-0x0000000005B40000-0x0000000005B62000-memory.dmp
memory/2140-8-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/2140-7-0x0000000006250000-0x00000000062B6000-memory.dmp
memory/2140-41-0x00000000080E0000-0x00000000080F1000-memory.dmp
memory/2140-28-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2140-40-0x0000000008180000-0x0000000008216000-memory.dmp
memory/2140-30-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2140-39-0x00000000080C0000-0x00000000080CA000-memory.dmp
memory/2140-16-0x00000000063B0000-0x0000000006704000-memory.dmp
memory/2140-38-0x0000000007FD0000-0x0000000008073000-memory.dmp
memory/2140-17-0x00000000069F0000-0x0000000006A0E000-memory.dmp
memory/2140-18-0x0000000006A20000-0x0000000006A6C000-memory.dmp
memory/2140-37-0x0000000007FB0000-0x0000000007FCE000-memory.dmp
memory/2140-19-0x0000000006F70000-0x0000000006FB4000-memory.dmp
memory/2140-24-0x0000000007F70000-0x0000000007FA2000-memory.dmp
memory/2140-45-0x0000000008170000-0x0000000008178000-memory.dmp
memory/2140-22-0x0000000007DC0000-0x0000000007DDA000-memory.dmp
memory/2140-21-0x0000000008420000-0x0000000008A9A000-memory.dmp
memory/2140-25-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/2140-23-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
memory/2716-70-0x00000000078C0000-0x00000000078D1000-memory.dmp
memory/2716-71-0x0000000007910000-0x0000000007924000-memory.dmp
memory/2716-52-0x0000000005D20000-0x0000000006074000-memory.dmp
memory/2716-61-0x0000000070670000-0x00000000709C4000-memory.dmp
memory/2716-69-0x0000000007590000-0x0000000007633000-memory.dmp
memory/2716-60-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/2932-121-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/3352-195-0x0000000007690000-0x0000000007733000-memory.dmp
memory/3352-187-0x0000000070650000-0x00000000709A4000-memory.dmp
memory/3352-186-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/3352-196-0x00000000079B0000-0x00000000079C1000-memory.dmp
memory/3352-197-0x0000000006220000-0x0000000006234000-memory.dmp
memory/4128-225-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4128-269-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4128-231-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4128-277-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4128-217-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4128-228-0x0000000000400000-0x0000000002EE9000-memory.dmp
memory/4148-138-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/4148-157-0x0000000005C20000-0x0000000005C34000-memory.dmp
memory/4148-139-0x0000000070650000-0x00000000709A4000-memory.dmp
memory/4148-147-0x0000000007390000-0x00000000073A1000-memory.dmp
memory/4400-181-0x0000000005DE0000-0x0000000005DF4000-memory.dmp
memory/4400-177-0x00000000058D0000-0x00000000058E1000-memory.dmp
memory/4400-166-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/4400-167-0x0000000070650000-0x00000000709A4000-memory.dmp
memory/4400-175-0x00000000075A0000-0x0000000007643000-memory.dmp
memory/4564-104-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/4564-105-0x0000000070070000-0x00000000703C4000-memory.dmp
memory/4564-102-0x0000000005960000-0x0000000005CB4000-memory.dmp
memory/4612-185-0x0000000000400000-0x0000000002EE9000-memory.dmp