Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
11-11-2023 07:49
Behavioral task
behavioral1
Sample
WheatEngine/Wheat.exe
Resource
win7-20231025-en
windows7-x64
4 signatures
150 seconds
General
-
Target
WheatEngine/Wheat.exe
-
Size
495KB
-
MD5
4e2a73bd98c17dd035e693d38d96b829
-
SHA1
be8facb176e8d0bfb14c42d969a6f37d53bd5dce
-
SHA256
5dcb951d3badbefb19c3e5af092f3b3561ad272ff75b41e1f84cd27dd88969dd
-
SHA512
4b4d1829fdac62f24b54871a3e09156ec17a3d943c1d3fa22bbf05d2f1523fee3ad3bae9afe9aa1ff0056e8cd19c0bfab2aa4c9471b24b3a5b454860b40f67a8
-
SSDEEP
6144:floZMDXU9Zx0kt8X0/PSCsMnVRaYe5xyDXKYZd8jNb8e1mziN:doZnf0kkPaVRaYe5xyDXKYZd85l
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2244-0-0x0000000000EF0000-0x0000000000F72000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2244 Wheat.exe Token: SeIncreaseQuotaPrivilege 2680 wmic.exe Token: SeSecurityPrivilege 2680 wmic.exe Token: SeTakeOwnershipPrivilege 2680 wmic.exe Token: SeLoadDriverPrivilege 2680 wmic.exe Token: SeSystemProfilePrivilege 2680 wmic.exe Token: SeSystemtimePrivilege 2680 wmic.exe Token: SeProfSingleProcessPrivilege 2680 wmic.exe Token: SeIncBasePriorityPrivilege 2680 wmic.exe Token: SeCreatePagefilePrivilege 2680 wmic.exe Token: SeBackupPrivilege 2680 wmic.exe Token: SeRestorePrivilege 2680 wmic.exe Token: SeShutdownPrivilege 2680 wmic.exe Token: SeDebugPrivilege 2680 wmic.exe Token: SeSystemEnvironmentPrivilege 2680 wmic.exe Token: SeRemoteShutdownPrivilege 2680 wmic.exe Token: SeUndockPrivilege 2680 wmic.exe Token: SeManageVolumePrivilege 2680 wmic.exe Token: 33 2680 wmic.exe Token: 34 2680 wmic.exe Token: 35 2680 wmic.exe Token: SeIncreaseQuotaPrivilege 2680 wmic.exe Token: SeSecurityPrivilege 2680 wmic.exe Token: SeTakeOwnershipPrivilege 2680 wmic.exe Token: SeLoadDriverPrivilege 2680 wmic.exe Token: SeSystemProfilePrivilege 2680 wmic.exe Token: SeSystemtimePrivilege 2680 wmic.exe Token: SeProfSingleProcessPrivilege 2680 wmic.exe Token: SeIncBasePriorityPrivilege 2680 wmic.exe Token: SeCreatePagefilePrivilege 2680 wmic.exe Token: SeBackupPrivilege 2680 wmic.exe Token: SeRestorePrivilege 2680 wmic.exe Token: SeShutdownPrivilege 2680 wmic.exe Token: SeDebugPrivilege 2680 wmic.exe Token: SeSystemEnvironmentPrivilege 2680 wmic.exe Token: SeRemoteShutdownPrivilege 2680 wmic.exe Token: SeUndockPrivilege 2680 wmic.exe Token: SeManageVolumePrivilege 2680 wmic.exe Token: 33 2680 wmic.exe Token: 34 2680 wmic.exe Token: 35 2680 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2680 2244 Wheat.exe 30 PID 2244 wrote to memory of 2680 2244 Wheat.exe 30 PID 2244 wrote to memory of 2680 2244 Wheat.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\WheatEngine\Wheat.exe"C:\Users\Admin\AppData\Local\Temp\WheatEngine\Wheat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680
-