Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21-08-2023 16:25
Behavioral task
behavioral1
Sample
3S.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
General
-
Target
3S.exe
-
Size
227KB
-
MD5
0c6f57e34c60e926869925974c0ba0c6
-
SHA1
c2c96e1a4da5fe008796801569ebdfcde4d3c07b
-
SHA256
3818bc71c250768baec123373d2e873428509f7dcef12a56f4d428d488661c71
-
SHA512
70281ccd28331260e0808d00a0965753e4f8d9c4b8a0e211abd97556429ad7cb3a647a017f53a8d111468639fe9c05e0022cb034f6069b6b9fff214d389ac193
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4n6rk/1+mplsl3ySX6Eb8e1mai:ooZtL+EP8n6rk/1+mplsl3ySX30
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2412-54-0x0000000000D60000-0x0000000000DA0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2412 3S.exe Token: SeIncreaseQuotaPrivilege 2920 wmic.exe Token: SeSecurityPrivilege 2920 wmic.exe Token: SeTakeOwnershipPrivilege 2920 wmic.exe Token: SeLoadDriverPrivilege 2920 wmic.exe Token: SeSystemProfilePrivilege 2920 wmic.exe Token: SeSystemtimePrivilege 2920 wmic.exe Token: SeProfSingleProcessPrivilege 2920 wmic.exe Token: SeIncBasePriorityPrivilege 2920 wmic.exe Token: SeCreatePagefilePrivilege 2920 wmic.exe Token: SeBackupPrivilege 2920 wmic.exe Token: SeRestorePrivilege 2920 wmic.exe Token: SeShutdownPrivilege 2920 wmic.exe Token: SeDebugPrivilege 2920 wmic.exe Token: SeSystemEnvironmentPrivilege 2920 wmic.exe Token: SeRemoteShutdownPrivilege 2920 wmic.exe Token: SeUndockPrivilege 2920 wmic.exe Token: SeManageVolumePrivilege 2920 wmic.exe Token: 33 2920 wmic.exe Token: 34 2920 wmic.exe Token: 35 2920 wmic.exe Token: SeIncreaseQuotaPrivilege 2920 wmic.exe Token: SeSecurityPrivilege 2920 wmic.exe Token: SeTakeOwnershipPrivilege 2920 wmic.exe Token: SeLoadDriverPrivilege 2920 wmic.exe Token: SeSystemProfilePrivilege 2920 wmic.exe Token: SeSystemtimePrivilege 2920 wmic.exe Token: SeProfSingleProcessPrivilege 2920 wmic.exe Token: SeIncBasePriorityPrivilege 2920 wmic.exe Token: SeCreatePagefilePrivilege 2920 wmic.exe Token: SeBackupPrivilege 2920 wmic.exe Token: SeRestorePrivilege 2920 wmic.exe Token: SeShutdownPrivilege 2920 wmic.exe Token: SeDebugPrivilege 2920 wmic.exe Token: SeSystemEnvironmentPrivilege 2920 wmic.exe Token: SeRemoteShutdownPrivilege 2920 wmic.exe Token: SeUndockPrivilege 2920 wmic.exe Token: SeManageVolumePrivilege 2920 wmic.exe Token: 33 2920 wmic.exe Token: 34 2920 wmic.exe Token: 35 2920 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2920 2412 3S.exe 28 PID 2412 wrote to memory of 2920 2412 3S.exe 28 PID 2412 wrote to memory of 2920 2412 3S.exe 28