Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 21:05
Behavioral task
behavioral1
Sample
rbxfpsunlocker.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
rbxfpsunlocker.exe
-
Size
234KB
-
MD5
18b7413ddfaa6df7f7405f642c10a287
-
SHA1
e64389a600d859dd07e0fdb2df12a7d9b4d09581
-
SHA256
84b074f1eaf50dab59347bf6122b411dbeb5c4952ffe30776cf1a88881e45436
-
SHA512
94c78d9bb0b2044675885eb02ee698c6215d90d4dce3fea1ed350977b712c5b9315f596260d9752855d8c9cdbd531bea9999311bc9527158347aebbf367864f9
-
SSDEEP
6144:DloZMLrIkd8g+EtXHkv/iD4YyO2un9GuBQ0dP6aPZ/b8e1mIRtVi:hoZ0L+EP8YyO2un9GuBQ0dP6aP1tf8
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2708-0-0x0000000000D60000-0x0000000000DA0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2708 rbxfpsunlocker.exe Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2916 2708 rbxfpsunlocker.exe 29 PID 2708 wrote to memory of 2916 2708 rbxfpsunlocker.exe 29 PID 2708 wrote to memory of 2916 2708 rbxfpsunlocker.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-