Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2023 21:01
General
-
Target
Recuro Ext v2.exe
-
Size
229KB
-
MD5
d7012377350fd49496b9204c27fee5c3
-
SHA1
6e1626fa282224e2e4970c29df0960098b60f775
-
SHA256
03f48b05a4b0d4070d0c10dc264b64a2edf0a4c767dfc499e045f84f6c9b271b
-
SHA512
88f1b96894253e3f5f14a22a02f43654b8abdf7b084ac9a38278aa7898503c00e35db2c81a1f691d9ed629df7a29ce190bd51f3ff35b3570d7e1d8a30ad617d3
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4cu5xClK8e1mVWi:noZtL+EP87qqI
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3136-0-0x00000240ACEA0000-0x00000240ACEE0000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3136 Recuro Ext v2.exe Token: SeIncreaseQuotaPrivilege 2844 wmic.exe Token: SeSecurityPrivilege 2844 wmic.exe Token: SeTakeOwnershipPrivilege 2844 wmic.exe Token: SeLoadDriverPrivilege 2844 wmic.exe Token: SeSystemProfilePrivilege 2844 wmic.exe Token: SeSystemtimePrivilege 2844 wmic.exe Token: SeProfSingleProcessPrivilege 2844 wmic.exe Token: SeIncBasePriorityPrivilege 2844 wmic.exe Token: SeCreatePagefilePrivilege 2844 wmic.exe Token: SeBackupPrivilege 2844 wmic.exe Token: SeRestorePrivilege 2844 wmic.exe Token: SeShutdownPrivilege 2844 wmic.exe Token: SeDebugPrivilege 2844 wmic.exe Token: SeSystemEnvironmentPrivilege 2844 wmic.exe Token: SeRemoteShutdownPrivilege 2844 wmic.exe Token: SeUndockPrivilege 2844 wmic.exe Token: SeManageVolumePrivilege 2844 wmic.exe Token: 33 2844 wmic.exe Token: 34 2844 wmic.exe Token: 35 2844 wmic.exe Token: 36 2844 wmic.exe Token: SeIncreaseQuotaPrivilege 2844 wmic.exe Token: SeSecurityPrivilege 2844 wmic.exe Token: SeTakeOwnershipPrivilege 2844 wmic.exe Token: SeLoadDriverPrivilege 2844 wmic.exe Token: SeSystemProfilePrivilege 2844 wmic.exe Token: SeSystemtimePrivilege 2844 wmic.exe Token: SeProfSingleProcessPrivilege 2844 wmic.exe Token: SeIncBasePriorityPrivilege 2844 wmic.exe Token: SeCreatePagefilePrivilege 2844 wmic.exe Token: SeBackupPrivilege 2844 wmic.exe Token: SeRestorePrivilege 2844 wmic.exe Token: SeShutdownPrivilege 2844 wmic.exe Token: SeDebugPrivilege 2844 wmic.exe Token: SeSystemEnvironmentPrivilege 2844 wmic.exe Token: SeRemoteShutdownPrivilege 2844 wmic.exe Token: SeUndockPrivilege 2844 wmic.exe Token: SeManageVolumePrivilege 2844 wmic.exe Token: 33 2844 wmic.exe Token: 34 2844 wmic.exe Token: 35 2844 wmic.exe Token: 36 2844 wmic.exe Token: SeDebugPrivilege 3232 taskmgr.exe Token: SeSystemProfilePrivilege 3232 taskmgr.exe Token: SeCreateGlobalPrivilege 3232 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3136 wrote to memory of 2844 3136 Recuro Ext v2.exe 85 PID 3136 wrote to memory of 2844 3136 Recuro Ext v2.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recuro Ext v2.exe"C:\Users\Admin\AppData\Local\Temp\Recuro Ext v2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3232