Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 11:20
Behavioral task
behavioral1
Sample
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe
-
Size
229KB
-
MD5
248459e9a88f59cd50f7f3c2a6b849bf
-
SHA1
1f8a8674e8425ff3edcc377f12569890f96c734c
-
SHA256
f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0
-
SHA512
18a64fe8d32ba3bdc497ffd7b4f20247c32e50fb438319f2abd9fc74f56c32edc73d9e39592d1e46fcf51eb2bb03ad1d25d23da0bc394d9eba612264d008ec55
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4ejXlbiAfbo3xUyzzq1eb8e1mTi:voZtL+EP8ejXlbiAfbo3xUyzzqEZ
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4296-0-0x000001E06B380000-0x000001E06B3C0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4296 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe Token: SeIncreaseQuotaPrivilege 3532 wmic.exe Token: SeSecurityPrivilege 3532 wmic.exe Token: SeTakeOwnershipPrivilege 3532 wmic.exe Token: SeLoadDriverPrivilege 3532 wmic.exe Token: SeSystemProfilePrivilege 3532 wmic.exe Token: SeSystemtimePrivilege 3532 wmic.exe Token: SeProfSingleProcessPrivilege 3532 wmic.exe Token: SeIncBasePriorityPrivilege 3532 wmic.exe Token: SeCreatePagefilePrivilege 3532 wmic.exe Token: SeBackupPrivilege 3532 wmic.exe Token: SeRestorePrivilege 3532 wmic.exe Token: SeShutdownPrivilege 3532 wmic.exe Token: SeDebugPrivilege 3532 wmic.exe Token: SeSystemEnvironmentPrivilege 3532 wmic.exe Token: SeRemoteShutdownPrivilege 3532 wmic.exe Token: SeUndockPrivilege 3532 wmic.exe Token: SeManageVolumePrivilege 3532 wmic.exe Token: 33 3532 wmic.exe Token: 34 3532 wmic.exe Token: 35 3532 wmic.exe Token: 36 3532 wmic.exe Token: SeIncreaseQuotaPrivilege 3532 wmic.exe Token: SeSecurityPrivilege 3532 wmic.exe Token: SeTakeOwnershipPrivilege 3532 wmic.exe Token: SeLoadDriverPrivilege 3532 wmic.exe Token: SeSystemProfilePrivilege 3532 wmic.exe Token: SeSystemtimePrivilege 3532 wmic.exe Token: SeProfSingleProcessPrivilege 3532 wmic.exe Token: SeIncBasePriorityPrivilege 3532 wmic.exe Token: SeCreatePagefilePrivilege 3532 wmic.exe Token: SeBackupPrivilege 3532 wmic.exe Token: SeRestorePrivilege 3532 wmic.exe Token: SeShutdownPrivilege 3532 wmic.exe Token: SeDebugPrivilege 3532 wmic.exe Token: SeSystemEnvironmentPrivilege 3532 wmic.exe Token: SeRemoteShutdownPrivilege 3532 wmic.exe Token: SeUndockPrivilege 3532 wmic.exe Token: SeManageVolumePrivilege 3532 wmic.exe Token: 33 3532 wmic.exe Token: 34 3532 wmic.exe Token: 35 3532 wmic.exe Token: 36 3532 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4296 wrote to memory of 3532 4296 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe 85 PID 4296 wrote to memory of 3532 4296 f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe"C:\Users\Admin\AppData\Local\Temp\f4b61c2c346acd3074699990972e4ef89c781801d4391b135e094579094de7f0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532
-