Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 17:35
Behavioral task
behavioral1
Sample
Celestial.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Celestial.exe
-
Size
264KB
-
MD5
d448a2df6f29c91c23b0d482fdb6ca49
-
SHA1
e533756132da1916cb3b6217edc066e72497bca3
-
SHA256
6ef6ef99e387801bbcb19f3295f0fa626fd2a0515a8f1947bce5d1f43fa6f968
-
SHA512
b1154c2cefb95e3e43738ac7a589c05482f126d7c325575a4540a100fac2691bd6bbeeb6105b8205132ae48fdbc68da4087a8d728e2529451ea342ae791ce6cf
-
SSDEEP
6144:DloZM+rIkd8g+EtXHkv/iD4rBKjuMzvEHlwOffuA1b8e1mDimV8vpFNEvt:hoZtL+EP8rBKjuMzvEHlwOffuUVm2vpX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2504-0-0x0000000000890000-0x00000000008D8000-memory.dmp family_umbral -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2760 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2504 Celestial.exe Token: SeIncreaseQuotaPrivilege 2800 wmic.exe Token: SeSecurityPrivilege 2800 wmic.exe Token: SeTakeOwnershipPrivilege 2800 wmic.exe Token: SeLoadDriverPrivilege 2800 wmic.exe Token: SeSystemProfilePrivilege 2800 wmic.exe Token: SeSystemtimePrivilege 2800 wmic.exe Token: SeProfSingleProcessPrivilege 2800 wmic.exe Token: SeIncBasePriorityPrivilege 2800 wmic.exe Token: SeCreatePagefilePrivilege 2800 wmic.exe Token: SeBackupPrivilege 2800 wmic.exe Token: SeRestorePrivilege 2800 wmic.exe Token: SeShutdownPrivilege 2800 wmic.exe Token: SeDebugPrivilege 2800 wmic.exe Token: SeSystemEnvironmentPrivilege 2800 wmic.exe Token: SeRemoteShutdownPrivilege 2800 wmic.exe Token: SeUndockPrivilege 2800 wmic.exe Token: SeManageVolumePrivilege 2800 wmic.exe Token: 33 2800 wmic.exe Token: 34 2800 wmic.exe Token: 35 2800 wmic.exe Token: SeIncreaseQuotaPrivilege 2800 wmic.exe Token: SeSecurityPrivilege 2800 wmic.exe Token: SeTakeOwnershipPrivilege 2800 wmic.exe Token: SeLoadDriverPrivilege 2800 wmic.exe Token: SeSystemProfilePrivilege 2800 wmic.exe Token: SeSystemtimePrivilege 2800 wmic.exe Token: SeProfSingleProcessPrivilege 2800 wmic.exe Token: SeIncBasePriorityPrivilege 2800 wmic.exe Token: SeCreatePagefilePrivilege 2800 wmic.exe Token: SeBackupPrivilege 2800 wmic.exe Token: SeRestorePrivilege 2800 wmic.exe Token: SeShutdownPrivilege 2800 wmic.exe Token: SeDebugPrivilege 2800 wmic.exe Token: SeSystemEnvironmentPrivilege 2800 wmic.exe Token: SeRemoteShutdownPrivilege 2800 wmic.exe Token: SeUndockPrivilege 2800 wmic.exe Token: SeManageVolumePrivilege 2800 wmic.exe Token: 33 2800 wmic.exe Token: 34 2800 wmic.exe Token: 35 2800 wmic.exe Token: SeDebugPrivilege 2760 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2800 2504 Celestial.exe 29 PID 2504 wrote to memory of 2800 2504 Celestial.exe 29 PID 2504 wrote to memory of 2800 2504 Celestial.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760