Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
11/01/2024, 14:06
General
- Target Yeezus.rar
- Size 10.2MB
- Sample240111-retcdshcdj
- SHA256 7f62f4def03ffd80426a25d462e04497eda6a8848529a1d8d51e7936ce6c1131
Malware Config
Signatures
- Detect Umbral payload 2 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Umbral
Umbral stealer is an opensource moduler stealer written in C#.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Yeezus.rar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Yeezus.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\Yeezus.exe"C:\Users\Admin\Desktop\Yeezus.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
InjectionLibrary.dll
InjectionLibrary.dll
InjectionLibrary.dll
ReaLTaiizor.dll
ReaLTaiizor.dll
ReaLTaiizor.dll
Yeezus.exe
Yeezus.exe
memory/1340-89-0x00007FFE85840000-0x00007FFE86301000-memory.dmp
memory/1340-83-0x00007FFE85840000-0x00007FFE86301000-memory.dmp
memory/1340-87-0x0000020978DE0000-0x0000020978DF0000-memory.dmp
memory/1340-82-0x000002095E760000-0x000002095E7A0000-memory.dmp
memory/2356-24-0x0000000002C40000-0x0000000002C76000-memory.dmp
memory/2356-45-0x0000000006B00000-0x0000000006B32000-memory.dmp
memory/2356-70-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/2356-65-0x0000000007AB0000-0x0000000007AC4000-memory.dmp
memory/2356-67-0x0000000007B90000-0x0000000007B98000-memory.dmp
memory/2356-66-0x0000000007BB0000-0x0000000007BCA000-memory.dmp
memory/2356-25-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/2356-26-0x0000000005830000-0x0000000005E58000-memory.dmp
memory/2356-28-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/2356-27-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/2356-39-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/2356-40-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/2356-41-0x00000000060B0000-0x0000000006404000-memory.dmp
memory/2356-29-0x0000000005790000-0x00000000057B2000-memory.dmp
memory/2356-42-0x0000000006550000-0x000000000656E000-memory.dmp
memory/2356-43-0x0000000006580000-0x00000000065CC000-memory.dmp
memory/2356-64-0x0000000007AA0000-0x0000000007AAE000-memory.dmp
memory/2356-46-0x0000000070510000-0x000000007055C000-memory.dmp
memory/2356-58-0x0000000007730000-0x00000000077D3000-memory.dmp
memory/2356-57-0x0000000006AE0000-0x0000000006AFE000-memory.dmp
memory/2356-56-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/2356-60-0x0000000007870000-0x000000000788A000-memory.dmp
memory/2356-59-0x0000000007EC0000-0x000000000853A000-memory.dmp
memory/2356-63-0x0000000007A70000-0x0000000007A81000-memory.dmp
memory/2356-44-0x000000007F8C0000-0x000000007F8D0000-memory.dmp
memory/2356-61-0x00000000078F0000-0x00000000078FA000-memory.dmp
memory/2356-62-0x0000000007AF0000-0x0000000007B86000-memory.dmp
memory/3572-10-0x0000000006050000-0x0000000006051000-memory.dmp
memory/3572-84-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-23-0x000000000AAB0000-0x000000000B024000-memory.dmp
memory/3572-12-0x0000000006EE0000-0x0000000007484000-memory.dmp
memory/3572-13-0x0000000006A20000-0x0000000006AB2000-memory.dmp
memory/3572-22-0x0000000006D80000-0x0000000006D8A000-memory.dmp
memory/3572-11-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-85-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-17-0x0000000008830000-0x0000000009288000-memory.dmp
memory/3572-21-0x0000000006BC0000-0x0000000006BDC000-memory.dmp
memory/3572-86-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-9-0x0000000000A20000-0x0000000001D92000-memory.dmp
memory/3572-8-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/3572-90-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/3572-91-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-92-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-94-0x0000000006560000-0x0000000006570000-memory.dmp
memory/3572-93-0x0000000006560000-0x0000000006570000-memory.dmp