Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 11:20
Behavioral task
behavioral1
Sample
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe
-
Size
229KB
-
MD5
248459e9a88f59cd50f7f3c2a6b849bf
-
SHA1
1f8a8674e8425ff3edcc377f12569890f96c734c
-
SHA256
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0
-
SHA512
18a64fe8d32ba3bdc497ffd7b4f20247c32e50fb438319f2abd9fc74f56c32edc73d9e39592d1e46fcf51eb2bb03ad1d25d23da0bc394d9eba612264d008ec55
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4ejXlbiAfbo3xUyzzq1eb8e1mTi:voZtL+EP8ejXlbiAfbo3xUyzzqEZ
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/1624-0-0x0000000000A60000-0x0000000000AA0000-memory.dmp family_umbral behavioral1/memory/1624-2-0x000000001B260000-0x000000001B2E0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1624 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe Token: SeIncreaseQuotaPrivilege 2748 wmic.exe Token: SeSecurityPrivilege 2748 wmic.exe Token: SeTakeOwnershipPrivilege 2748 wmic.exe Token: SeLoadDriverPrivilege 2748 wmic.exe Token: SeSystemProfilePrivilege 2748 wmic.exe Token: SeSystemtimePrivilege 2748 wmic.exe Token: SeProfSingleProcessPrivilege 2748 wmic.exe Token: SeIncBasePriorityPrivilege 2748 wmic.exe Token: SeCreatePagefilePrivilege 2748 wmic.exe Token: SeBackupPrivilege 2748 wmic.exe Token: SeRestorePrivilege 2748 wmic.exe Token: SeShutdownPrivilege 2748 wmic.exe Token: SeDebugPrivilege 2748 wmic.exe Token: SeSystemEnvironmentPrivilege 2748 wmic.exe Token: SeRemoteShutdownPrivilege 2748 wmic.exe Token: SeUndockPrivilege 2748 wmic.exe Token: SeManageVolumePrivilege 2748 wmic.exe Token: 33 2748 wmic.exe Token: 34 2748 wmic.exe Token: 35 2748 wmic.exe Token: SeIncreaseQuotaPrivilege 2748 wmic.exe Token: SeSecurityPrivilege 2748 wmic.exe Token: SeTakeOwnershipPrivilege 2748 wmic.exe Token: SeLoadDriverPrivilege 2748 wmic.exe Token: SeSystemProfilePrivilege 2748 wmic.exe Token: SeSystemtimePrivilege 2748 wmic.exe Token: SeProfSingleProcessPrivilege 2748 wmic.exe Token: SeIncBasePriorityPrivilege 2748 wmic.exe Token: SeCreatePagefilePrivilege 2748 wmic.exe Token: SeBackupPrivilege 2748 wmic.exe Token: SeRestorePrivilege 2748 wmic.exe Token: SeShutdownPrivilege 2748 wmic.exe Token: SeDebugPrivilege 2748 wmic.exe Token: SeSystemEnvironmentPrivilege 2748 wmic.exe Token: SeRemoteShutdownPrivilege 2748 wmic.exe Token: SeUndockPrivilege 2748 wmic.exe Token: SeManageVolumePrivilege 2748 wmic.exe Token: 33 2748 wmic.exe Token: 34 2748 wmic.exe Token: 35 2748 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2748 1624 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe 28 PID 1624 wrote to memory of 2748 1624 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe 28 PID 1624 wrote to memory of 2748 1624 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe"C:\Users\Admin\AppData\Local\Temp\f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-