glupteba | 604951251012547c2e76fe2fa03d336fe081b455b7537303f6eba9f6f87f5384

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_5c9decc357b41bd6543365e21e62e675_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260824-m2wc2sstct
SHA256 604951251012547c2e76fe2fa03d336fe081b455b7537303f6eba9f6f87f5384
MD5 5c9decc357b41bd6543365e21e62e675
SHA1 7bcd0cba7e5362398f5522afa59aeccd2e55f80c
SHA512 ec46b1fb3340c0fc74c1d7dc9ab30e402e3f0bd865867aba7aed16e6768f8993f8fd9892b640b006c282eb0b61712c4368c084a209d4e778d51d59ae77d682a1
SSDEEP 98304:UFu4EX/FcNJ+e2UcuFGNBf2e3kPmgbwqebgFNVeSD7T:Ku4p2XxNtWbbfeUpL7T
TLSH
T11A263320AAB1D035F47A72789678B2E4783F3DA09B5D71CF92C617F882646E19C31367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery dropper glupteba metasploit loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/memory/3564-2-0x0000000005870000-0x0000000006112000-memory.dmp	family_glupteba

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	3564	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_5c9decc357b41bd6543365e21e62e675_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_5c9decc357b41bd6543365e21e62e675_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_5c9decc357b41bd6543365e21e62e675_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 312
  2⤵
  - Program crash
  PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3564 -ip 3564
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3564-1-0x0000000005450000-0x000000000586E000-memory.dmp

Download

memory/3564-2-0x0000000005870000-0x0000000006112000-memory.dmp