Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
27-11-2023 02:54
Behavioral task
behavioral1
Sample
d7012377350fd49496b9204c27fee5c3.exe
Resource
win7-20231025-en
windows7-x64
4 signatures
150 seconds
General
-
Target
d7012377350fd49496b9204c27fee5c3.exe
-
Size
229KB
-
MD5
d7012377350fd49496b9204c27fee5c3
-
SHA1
6e1626fa282224e2e4970c29df0960098b60f775
-
SHA256
03f48b05a4b0d4070d0c10dc264b64a2edf0a4c767dfc499e045f84f6c9b271b
-
SHA512
88f1b96894253e3f5f14a22a02f43654b8abdf7b084ac9a38278aa7898503c00e35db2c81a1f691d9ed629df7a29ce190bd51f3ff35b3570d7e1d8a30ad617d3
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4cu5xClK8e1mVWi:noZtL+EP87qqI
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2140-0-0x00000000011B0000-0x00000000011F0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2140 d7012377350fd49496b9204c27fee5c3.exe Token: SeIncreaseQuotaPrivilege 1768 wmic.exe Token: SeSecurityPrivilege 1768 wmic.exe Token: SeTakeOwnershipPrivilege 1768 wmic.exe Token: SeLoadDriverPrivilege 1768 wmic.exe Token: SeSystemProfilePrivilege 1768 wmic.exe Token: SeSystemtimePrivilege 1768 wmic.exe Token: SeProfSingleProcessPrivilege 1768 wmic.exe Token: SeIncBasePriorityPrivilege 1768 wmic.exe Token: SeCreatePagefilePrivilege 1768 wmic.exe Token: SeBackupPrivilege 1768 wmic.exe Token: SeRestorePrivilege 1768 wmic.exe Token: SeShutdownPrivilege 1768 wmic.exe Token: SeDebugPrivilege 1768 wmic.exe Token: SeSystemEnvironmentPrivilege 1768 wmic.exe Token: SeRemoteShutdownPrivilege 1768 wmic.exe Token: SeUndockPrivilege 1768 wmic.exe Token: SeManageVolumePrivilege 1768 wmic.exe Token: 33 1768 wmic.exe Token: 34 1768 wmic.exe Token: 35 1768 wmic.exe Token: SeIncreaseQuotaPrivilege 1768 wmic.exe Token: SeSecurityPrivilege 1768 wmic.exe Token: SeTakeOwnershipPrivilege 1768 wmic.exe Token: SeLoadDriverPrivilege 1768 wmic.exe Token: SeSystemProfilePrivilege 1768 wmic.exe Token: SeSystemtimePrivilege 1768 wmic.exe Token: SeProfSingleProcessPrivilege 1768 wmic.exe Token: SeIncBasePriorityPrivilege 1768 wmic.exe Token: SeCreatePagefilePrivilege 1768 wmic.exe Token: SeBackupPrivilege 1768 wmic.exe Token: SeRestorePrivilege 1768 wmic.exe Token: SeShutdownPrivilege 1768 wmic.exe Token: SeDebugPrivilege 1768 wmic.exe Token: SeSystemEnvironmentPrivilege 1768 wmic.exe Token: SeRemoteShutdownPrivilege 1768 wmic.exe Token: SeUndockPrivilege 1768 wmic.exe Token: SeManageVolumePrivilege 1768 wmic.exe Token: 33 1768 wmic.exe Token: 34 1768 wmic.exe Token: 35 1768 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1768 2140 d7012377350fd49496b9204c27fee5c3.exe 28 PID 2140 wrote to memory of 1768 2140 d7012377350fd49496b9204c27fee5c3.exe 28 PID 2140 wrote to memory of 1768 2140 d7012377350fd49496b9204c27fee5c3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7012377350fd49496b9204c27fee5c3.exe"C:\Users\Admin\AppData\Local\Temp\d7012377350fd49496b9204c27fee5c3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768
-