Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Spoofer.exe
-
Size
1.2MB
-
MD5
d4041cc3e5034ae1ef88af893b2f5b15
-
SHA1
b4a5312e96d4618b067b2865ec75b88806162ccc
-
SHA256
93223f738657509b016c39bb9d2c7728d698391afe35ce95fb775c32e2d11c3b
-
SHA512
0b3eaa222ec8905bc3163eca5abef8ab1cd39d4c898f3e617dd1257c98f3c8fd533898cc5f91006416bd5a82c23db0ac3400a3f74beda34e2c54d9ba1b1605c7
-
SSDEEP
24576:5GKxdvVStCsVR+bkSe/oREP64Ng0o48I0zEMM:wKxdvcQsVRm/+j6DRFREMM
Malware Config
Extracted
Family
umbral
C2
https://discord.com/api/webhooks/1190042379600797716/_o3srVE7TGd9h-tXYsjqIoul_MAhdkguDLRahVco32Q3wx_y9SxlyFBxvxjJsCXHT46C
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/memory/4404-1-0x0000000000D50000-0x000000000110C000-memory.dmp family_umbral behavioral2/memory/4404-8-0x0000000000D50000-0x000000000110C000-memory.dmp family_umbral -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4404 Spoofer.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4404 Spoofer.exe Token: SeIncreaseQuotaPrivilege 3524 wmic.exe Token: SeSecurityPrivilege 3524 wmic.exe Token: SeTakeOwnershipPrivilege 3524 wmic.exe Token: SeLoadDriverPrivilege 3524 wmic.exe Token: SeSystemProfilePrivilege 3524 wmic.exe Token: SeSystemtimePrivilege 3524 wmic.exe Token: SeProfSingleProcessPrivilege 3524 wmic.exe Token: SeIncBasePriorityPrivilege 3524 wmic.exe Token: SeCreatePagefilePrivilege 3524 wmic.exe Token: SeBackupPrivilege 3524 wmic.exe Token: SeRestorePrivilege 3524 wmic.exe Token: SeShutdownPrivilege 3524 wmic.exe Token: SeDebugPrivilege 3524 wmic.exe Token: SeSystemEnvironmentPrivilege 3524 wmic.exe Token: SeRemoteShutdownPrivilege 3524 wmic.exe Token: SeUndockPrivilege 3524 wmic.exe Token: SeManageVolumePrivilege 3524 wmic.exe Token: 33 3524 wmic.exe Token: 34 3524 wmic.exe Token: 35 3524 wmic.exe Token: 36 3524 wmic.exe Token: SeIncreaseQuotaPrivilege 3524 wmic.exe Token: SeSecurityPrivilege 3524 wmic.exe Token: SeTakeOwnershipPrivilege 3524 wmic.exe Token: SeLoadDriverPrivilege 3524 wmic.exe Token: SeSystemProfilePrivilege 3524 wmic.exe Token: SeSystemtimePrivilege 3524 wmic.exe Token: SeProfSingleProcessPrivilege 3524 wmic.exe Token: SeIncBasePriorityPrivilege 3524 wmic.exe Token: SeCreatePagefilePrivilege 3524 wmic.exe Token: SeBackupPrivilege 3524 wmic.exe Token: SeRestorePrivilege 3524 wmic.exe Token: SeShutdownPrivilege 3524 wmic.exe Token: SeDebugPrivilege 3524 wmic.exe Token: SeSystemEnvironmentPrivilege 3524 wmic.exe Token: SeRemoteShutdownPrivilege 3524 wmic.exe Token: SeUndockPrivilege 3524 wmic.exe Token: SeManageVolumePrivilege 3524 wmic.exe Token: 33 3524 wmic.exe Token: 34 3524 wmic.exe Token: 35 3524 wmic.exe Token: 36 3524 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4404 Spoofer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4404 wrote to memory of 3524 4404 Spoofer.exe 57 PID 4404 wrote to memory of 3524 4404 Spoofer.exe 57 PID 4404 wrote to memory of 3524 4404 Spoofer.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524
-