Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 21:05
Behavioral task
behavioral1
Sample
rbxfpsunlocker.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
rbxfpsunlocker.exe
-
Size
235KB
-
MD5
cef4e684fe752c81d8a1373e622719e0
-
SHA1
ed204610451f108b441d3b7b06b3dc95aeda80e4
-
SHA256
24d2bc2920f563e67a63e82a6ad93c61e2a1e118e927385f71f55755ce8763cc
-
SHA512
d07e6f763e0f970ac63e8dd7a3fe2b6bd6f38d91f0ebfadba8d6bd650b27c03cd68893d4de800078eafb75b6f24ac004976500585a8b7266ed64680827020f38
-
SSDEEP
6144:TloZM+rIkd8g+EtXHkv/iD4dcFMrRiK1iwBzOurmaqb8e1mgui:RoZtL+EP8dcFMrRiK1iwBzOuroND
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2240-0-0x0000000000E90000-0x0000000000ED0000-memory.dmp family_umbral behavioral1/memory/2240-2-0x000000001B230000-0x000000001B2B0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2240 rbxfpsunlocker.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2720 2240 rbxfpsunlocker.exe 29 PID 2240 wrote to memory of 2720 2240 rbxfpsunlocker.exe 29 PID 2240 wrote to memory of 2720 2240 rbxfpsunlocker.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720
-