Analysis
-
max time kernel
39s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2023 15:20
General
-
Target
rbxfpsunlocker.exe
-
Size
234KB
-
MD5
18b7413ddfaa6df7f7405f642c10a287
-
SHA1
e64389a600d859dd07e0fdb2df12a7d9b4d09581
-
SHA256
84b074f1eaf50dab59347bf6122b411dbeb5c4952ffe30776cf1a88881e45436
-
SHA512
94c78d9bb0b2044675885eb02ee698c6215d90d4dce3fea1ed350977b712c5b9315f596260d9752855d8c9cdbd531bea9999311bc9527158347aebbf367864f9
-
SSDEEP
6144:DloZMLrIkd8g+EtXHkv/iD4YyO2un9GuBQ0dP6aPZ/b8e1mIRtVi:hoZ0L+EP8YyO2un9GuBQ0dP6aP1tf8
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1852-0-0x0000021C79480000-0x0000021C794C0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1852 rbxfpsunlocker.exe Token: SeIncreaseQuotaPrivilege 4560 wmic.exe Token: SeSecurityPrivilege 4560 wmic.exe Token: SeTakeOwnershipPrivilege 4560 wmic.exe Token: SeLoadDriverPrivilege 4560 wmic.exe Token: SeSystemProfilePrivilege 4560 wmic.exe Token: SeSystemtimePrivilege 4560 wmic.exe Token: SeProfSingleProcessPrivilege 4560 wmic.exe Token: SeIncBasePriorityPrivilege 4560 wmic.exe Token: SeCreatePagefilePrivilege 4560 wmic.exe Token: SeBackupPrivilege 4560 wmic.exe Token: SeRestorePrivilege 4560 wmic.exe Token: SeShutdownPrivilege 4560 wmic.exe Token: SeDebugPrivilege 4560 wmic.exe Token: SeSystemEnvironmentPrivilege 4560 wmic.exe Token: SeRemoteShutdownPrivilege 4560 wmic.exe Token: SeUndockPrivilege 4560 wmic.exe Token: SeManageVolumePrivilege 4560 wmic.exe Token: 33 4560 wmic.exe Token: 34 4560 wmic.exe Token: 35 4560 wmic.exe Token: 36 4560 wmic.exe Token: SeIncreaseQuotaPrivilege 4560 wmic.exe Token: SeSecurityPrivilege 4560 wmic.exe Token: SeTakeOwnershipPrivilege 4560 wmic.exe Token: SeLoadDriverPrivilege 4560 wmic.exe Token: SeSystemProfilePrivilege 4560 wmic.exe Token: SeSystemtimePrivilege 4560 wmic.exe Token: SeProfSingleProcessPrivilege 4560 wmic.exe Token: SeIncBasePriorityPrivilege 4560 wmic.exe Token: SeCreatePagefilePrivilege 4560 wmic.exe Token: SeBackupPrivilege 4560 wmic.exe Token: SeRestorePrivilege 4560 wmic.exe Token: SeShutdownPrivilege 4560 wmic.exe Token: SeDebugPrivilege 4560 wmic.exe Token: SeSystemEnvironmentPrivilege 4560 wmic.exe Token: SeRemoteShutdownPrivilege 4560 wmic.exe Token: SeUndockPrivilege 4560 wmic.exe Token: SeManageVolumePrivilege 4560 wmic.exe Token: 33 4560 wmic.exe Token: 34 4560 wmic.exe Token: 35 4560 wmic.exe Token: 36 4560 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1852 wrote to memory of 4560 1852 rbxfpsunlocker.exe 86 PID 1852 wrote to memory of 4560 1852 rbxfpsunlocker.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560
-