Analysis
-
max time kernel
164s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 01:36
Behavioral task
behavioral1
Sample
dx9injector.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
dx9injector.exe
-
Size
632KB
-
MD5
d69d90a0ac5890b22e0932e7a24ba9c2
-
SHA1
d303ab6a4cf6e7ab113a60e2392a8ae42b455c07
-
SHA256
96ac460a603a209e2c8167613b292181f7f2f5ede977258a096f7d2c4f1e3870
-
SHA512
ec4804d65edf28de02d9889f83e37c0262da3e875a2707050213799662676f5ac9824b388f15f38312d6b303276b7a8a9cb3803e655087dce0f1d336b89bc7c8
-
SSDEEP
6144:XloZMLrIkd8g+EtXHkv/iD4PNWNvFuW558VHCCHTib8e1mKivanvOG2NYg7Cn+A7:1oZ0L+EP8PNWNvFuW558VHCCHy4LDA7
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2592-0-0x000002217CF90000-0x000002217D034000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2592 dx9injector.exe Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2592 wrote to memory of 4572 2592 dx9injector.exe 83 PID 2592 wrote to memory of 4572 2592 dx9injector.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\dx9injector.exe"C:\Users\Admin\AppData\Local\Temp\dx9injector.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572
-