Analysis
-
max time kernel
1815s -
max time network
1475s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2023, 11:50
Behavioral task
behavioral1
Sample
DX9WARE.zip
Resource
win10v2004-20231020-en
windows10-2004-x64
18 signatures
1800 seconds
Behavioral task
behavioral2
Sample
DX9WARE/Read First Before Open.txt
Resource
win10v2004-20231023-en
windows10-2004-x64
0 signatures
1800 seconds
General
-
Target
DX9WARE/dx9injector.exe
-
Size
632KB
-
MD5
acb1199c60d8458af181d560c3548f32
-
SHA1
343f54c729df7a767e3cfda60eb2ac30383a8b88
-
SHA256
35d545e19d430102709e03a9c9e27a90892e0e65717ac7731db51929cd631593
-
SHA512
c78c223bace7591c6b13ec3414f20db4bfc256df535b127eaafeb3aceed999b569a318380689fc8ca64f9877e790ea775f99f2051235c73a991683767993d685
-
SSDEEP
6144:3loZM+rIkd8g+EtXHkv/iD4kZ+a6YXzQTp8aLLyiQb8e1m0iHanvOG2NYg7Cn+A7:VoZtL+EP8kZ+a6YXzQTp8aLLybOTDA7
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral3/memory/1144-0-0x0000014F4D6C0000-0x0000014F4D764000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4400 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1144 dx9injector.exe Token: SeIncreaseQuotaPrivilege 4456 wmic.exe Token: SeSecurityPrivilege 4456 wmic.exe Token: SeTakeOwnershipPrivilege 4456 wmic.exe Token: SeLoadDriverPrivilege 4456 wmic.exe Token: SeSystemProfilePrivilege 4456 wmic.exe Token: SeSystemtimePrivilege 4456 wmic.exe Token: SeProfSingleProcessPrivilege 4456 wmic.exe Token: SeIncBasePriorityPrivilege 4456 wmic.exe Token: SeCreatePagefilePrivilege 4456 wmic.exe Token: SeBackupPrivilege 4456 wmic.exe Token: SeRestorePrivilege 4456 wmic.exe Token: SeShutdownPrivilege 4456 wmic.exe Token: SeDebugPrivilege 4456 wmic.exe Token: SeSystemEnvironmentPrivilege 4456 wmic.exe Token: SeRemoteShutdownPrivilege 4456 wmic.exe Token: SeUndockPrivilege 4456 wmic.exe Token: SeManageVolumePrivilege 4456 wmic.exe Token: 33 4456 wmic.exe Token: 34 4456 wmic.exe Token: 35 4456 wmic.exe Token: 36 4456 wmic.exe Token: SeIncreaseQuotaPrivilege 4456 wmic.exe Token: SeSecurityPrivilege 4456 wmic.exe Token: SeTakeOwnershipPrivilege 4456 wmic.exe Token: SeLoadDriverPrivilege 4456 wmic.exe Token: SeSystemProfilePrivilege 4456 wmic.exe Token: SeSystemtimePrivilege 4456 wmic.exe Token: SeProfSingleProcessPrivilege 4456 wmic.exe Token: SeIncBasePriorityPrivilege 4456 wmic.exe Token: SeCreatePagefilePrivilege 4456 wmic.exe Token: SeBackupPrivilege 4456 wmic.exe Token: SeRestorePrivilege 4456 wmic.exe Token: SeShutdownPrivilege 4456 wmic.exe Token: SeDebugPrivilege 4456 wmic.exe Token: SeSystemEnvironmentPrivilege 4456 wmic.exe Token: SeRemoteShutdownPrivilege 4456 wmic.exe Token: SeUndockPrivilege 4456 wmic.exe Token: SeManageVolumePrivilege 4456 wmic.exe Token: 33 4456 wmic.exe Token: 34 4456 wmic.exe Token: 35 4456 wmic.exe Token: 36 4456 wmic.exe Token: SeDebugPrivilege 4400 taskmgr.exe Token: SeSystemProfilePrivilege 4400 taskmgr.exe Token: SeCreateGlobalPrivilege 4400 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4456 1144 dx9injector.exe 88 PID 1144 wrote to memory of 4456 1144 dx9injector.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\DX9WARE\dx9injector.exe"C:\Users\Admin\AppData\Local\Temp\DX9WARE\dx9injector.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4400