Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-01-2024 14:06
General
-
Target
Yeezus.exe
-
Size
8.3MB
-
MD5
fcb147a5c323be1cd6341d87ee9eae35
-
SHA1
9ae4d2552158126efe96e7d9b92e782354bafefc
-
SHA256
a32ad6995d0a15c0b85485b36a92385f866fd119eb5a2678403f8201bb89e18c
-
SHA512
677156c85daf561398eef97e1e920c66cccfd342988d318b292d03694eac0b1a594adfbb7c3b5ac940234d2c165504fe1ff8dcd168ab14c49c63a0dbdca940f8
-
SSDEEP
196608:e64kbezidoC+okKRXDFk81sgJ2nMwDeCfLjtDwh31rnA4a9Tl:lbJdx+eDFk81sg4nMYjjto3o/
Score
10/10
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yeezus.exe"C:\Users\Admin\AppData\Local\Temp\Yeezus.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
19.4MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
10.3MB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
5.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB