Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
08/11/2023, 11:54
Behavioral task
behavioral1
Sample
NEAS.3cc7486085011fb3d3f39257947ab770.exe
Resource
win7-20231025-en
windows7-x64
4 signatures
150 seconds
General
-
Target
NEAS.3cc7486085011fb3d3f39257947ab770.exe
-
Size
229KB
-
MD5
3cc7486085011fb3d3f39257947ab770
-
SHA1
230da25f44a913d83513ef49c329823b23fb5cd8
-
SHA256
268b26611c7de33badf4450a94bd8500617a73de885a536e5392261639feb1fe
-
SHA512
bb6875f9225257a8bc26b9ced182b66d781948c41895b62f27272fc04f911ac90aa29e8288819b614d0ec30e4a98dd0163b634c81530fed5dd936acc2995ab5e
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4o/axsyVtGMTOMdRY3ub8e1m1i:noZtL+EP8o/axsyVtGMTOMdRYCP
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2932-0-0x00000000002A0000-0x00000000002E0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2932 NEAS.3cc7486085011fb3d3f39257947ab770.exe Token: SeIncreaseQuotaPrivilege 2836 wmic.exe Token: SeSecurityPrivilege 2836 wmic.exe Token: SeTakeOwnershipPrivilege 2836 wmic.exe Token: SeLoadDriverPrivilege 2836 wmic.exe Token: SeSystemProfilePrivilege 2836 wmic.exe Token: SeSystemtimePrivilege 2836 wmic.exe Token: SeProfSingleProcessPrivilege 2836 wmic.exe Token: SeIncBasePriorityPrivilege 2836 wmic.exe Token: SeCreatePagefilePrivilege 2836 wmic.exe Token: SeBackupPrivilege 2836 wmic.exe Token: SeRestorePrivilege 2836 wmic.exe Token: SeShutdownPrivilege 2836 wmic.exe Token: SeDebugPrivilege 2836 wmic.exe Token: SeSystemEnvironmentPrivilege 2836 wmic.exe Token: SeRemoteShutdownPrivilege 2836 wmic.exe Token: SeUndockPrivilege 2836 wmic.exe Token: SeManageVolumePrivilege 2836 wmic.exe Token: 33 2836 wmic.exe Token: 34 2836 wmic.exe Token: 35 2836 wmic.exe Token: SeIncreaseQuotaPrivilege 2836 wmic.exe Token: SeSecurityPrivilege 2836 wmic.exe Token: SeTakeOwnershipPrivilege 2836 wmic.exe Token: SeLoadDriverPrivilege 2836 wmic.exe Token: SeSystemProfilePrivilege 2836 wmic.exe Token: SeSystemtimePrivilege 2836 wmic.exe Token: SeProfSingleProcessPrivilege 2836 wmic.exe Token: SeIncBasePriorityPrivilege 2836 wmic.exe Token: SeCreatePagefilePrivilege 2836 wmic.exe Token: SeBackupPrivilege 2836 wmic.exe Token: SeRestorePrivilege 2836 wmic.exe Token: SeShutdownPrivilege 2836 wmic.exe Token: SeDebugPrivilege 2836 wmic.exe Token: SeSystemEnvironmentPrivilege 2836 wmic.exe Token: SeRemoteShutdownPrivilege 2836 wmic.exe Token: SeUndockPrivilege 2836 wmic.exe Token: SeManageVolumePrivilege 2836 wmic.exe Token: 33 2836 wmic.exe Token: 34 2836 wmic.exe Token: 35 2836 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2836 2932 NEAS.3cc7486085011fb3d3f39257947ab770.exe 28 PID 2932 wrote to memory of 2836 2932 NEAS.3cc7486085011fb3d3f39257947ab770.exe 28 PID 2932 wrote to memory of 2836 2932 NEAS.3cc7486085011fb3d3f39257947ab770.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3cc7486085011fb3d3f39257947ab770.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3cc7486085011fb3d3f39257947ab770.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-