Analysis
-
max time kernel
160s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 09:49
Behavioral task
behavioral1
Sample
Celestial.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Celestial.exe
-
Size
264KB
-
MD5
d448a2df6f29c91c23b0d482fdb6ca49
-
SHA1
e533756132da1916cb3b6217edc066e72497bca3
-
SHA256
6ef6ef99e387801bbcb19f3295f0fa626fd2a0515a8f1947bce5d1f43fa6f968
-
SHA512
b1154c2cefb95e3e43738ac7a589c05482f126d7c325575a4540a100fac2691bd6bbeeb6105b8205132ae48fdbc68da4087a8d728e2529451ea342ae791ce6cf
-
SSDEEP
6144:DloZM+rIkd8g+EtXHkv/iD4rBKjuMzvEHlwOffuA1b8e1mDimV8vpFNEvt:hoZtL+EP8rBKjuMzvEHlwOffuUVm2vpX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2024-0-0x0000021888B30000-0x0000021888B78000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2024 Celestial.exe Token: SeIncreaseQuotaPrivilege 2464 wmic.exe Token: SeSecurityPrivilege 2464 wmic.exe Token: SeTakeOwnershipPrivilege 2464 wmic.exe Token: SeLoadDriverPrivilege 2464 wmic.exe Token: SeSystemProfilePrivilege 2464 wmic.exe Token: SeSystemtimePrivilege 2464 wmic.exe Token: SeProfSingleProcessPrivilege 2464 wmic.exe Token: SeIncBasePriorityPrivilege 2464 wmic.exe Token: SeCreatePagefilePrivilege 2464 wmic.exe Token: SeBackupPrivilege 2464 wmic.exe Token: SeRestorePrivilege 2464 wmic.exe Token: SeShutdownPrivilege 2464 wmic.exe Token: SeDebugPrivilege 2464 wmic.exe Token: SeSystemEnvironmentPrivilege 2464 wmic.exe Token: SeRemoteShutdownPrivilege 2464 wmic.exe Token: SeUndockPrivilege 2464 wmic.exe Token: SeManageVolumePrivilege 2464 wmic.exe Token: 33 2464 wmic.exe Token: 34 2464 wmic.exe Token: 35 2464 wmic.exe Token: 36 2464 wmic.exe Token: SeIncreaseQuotaPrivilege 2464 wmic.exe Token: SeSecurityPrivilege 2464 wmic.exe Token: SeTakeOwnershipPrivilege 2464 wmic.exe Token: SeLoadDriverPrivilege 2464 wmic.exe Token: SeSystemProfilePrivilege 2464 wmic.exe Token: SeSystemtimePrivilege 2464 wmic.exe Token: SeProfSingleProcessPrivilege 2464 wmic.exe Token: SeIncBasePriorityPrivilege 2464 wmic.exe Token: SeCreatePagefilePrivilege 2464 wmic.exe Token: SeBackupPrivilege 2464 wmic.exe Token: SeRestorePrivilege 2464 wmic.exe Token: SeShutdownPrivilege 2464 wmic.exe Token: SeDebugPrivilege 2464 wmic.exe Token: SeSystemEnvironmentPrivilege 2464 wmic.exe Token: SeRemoteShutdownPrivilege 2464 wmic.exe Token: SeUndockPrivilege 2464 wmic.exe Token: SeManageVolumePrivilege 2464 wmic.exe Token: 33 2464 wmic.exe Token: 34 2464 wmic.exe Token: 35 2464 wmic.exe Token: 36 2464 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2464 2024 Celestial.exe 101 PID 2024 wrote to memory of 2464 2024 Celestial.exe 101