Analysis
- max time kernel
95s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
23/01/2024, 12:52
Behavioral task
behavioral1
Sample
proxy.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
- Target proxy.exe
- Size 246KB
- Sample240123-p4gzjsbbe9
- SHA256 4656d69359cd36909ffafde605da9acaa44f231465c2cf04083f312997a79143
- MD5 4ef1cda1badeab461aa59991f9499754
- SHA1 418fb087216cc11b6981a386fe4de673b089c3d8
- SHA512 2b4e6bcf02e18c8db8a703a109581928cdb741409e3b122a2fbdd387bac0aa8bcbcdc3e9b4673fe8309f1c885eed51b1feae505b18ccacfe9879712cf81aaf72
- SSDEEP 6144:ploZM+rIkd8g+EtXHkv/iD4EXNmxfEY3vmfh8It2qI8e1mZi:boZtL+EP8EXNmxfEY3vmfh8ItcH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4196-0-0x00000221FC170000-0x00000221FC1B4000-memory.dmp family_umbral - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4196 proxy.exe Token: SeIncreaseQuotaPrivilege 2008 wmic.exe Token: SeSecurityPrivilege 2008 wmic.exe Token: SeTakeOwnershipPrivilege 2008 wmic.exe Token: SeLoadDriverPrivilege 2008 wmic.exe Token: SeSystemProfilePrivilege 2008 wmic.exe Token: SeSystemtimePrivilege 2008 wmic.exe Token: SeProfSingleProcessPrivilege 2008 wmic.exe Token: SeIncBasePriorityPrivilege 2008 wmic.exe Token: SeCreatePagefilePrivilege 2008 wmic.exe Token: SeBackupPrivilege 2008 wmic.exe Token: SeRestorePrivilege 2008 wmic.exe Token: SeShutdownPrivilege 2008 wmic.exe Token: SeDebugPrivilege 2008 wmic.exe Token: SeSystemEnvironmentPrivilege 2008 wmic.exe Token: SeRemoteShutdownPrivilege 2008 wmic.exe Token: SeUndockPrivilege 2008 wmic.exe Token: SeManageVolumePrivilege 2008 wmic.exe Token: 33 2008 wmic.exe Token: 34 2008 wmic.exe Token: 35 2008 wmic.exe Token: 36 2008 wmic.exe Token: SeIncreaseQuotaPrivilege 2008 wmic.exe Token: SeSecurityPrivilege 2008 wmic.exe Token: SeTakeOwnershipPrivilege 2008 wmic.exe Token: SeLoadDriverPrivilege 2008 wmic.exe Token: SeSystemProfilePrivilege 2008 wmic.exe Token: SeSystemtimePrivilege 2008 wmic.exe Token: SeProfSingleProcessPrivilege 2008 wmic.exe Token: SeIncBasePriorityPrivilege 2008 wmic.exe Token: SeCreatePagefilePrivilege 2008 wmic.exe Token: SeBackupPrivilege 2008 wmic.exe Token: SeRestorePrivilege 2008 wmic.exe Token: SeShutdownPrivilege 2008 wmic.exe Token: SeDebugPrivilege 2008 wmic.exe Token: SeSystemEnvironmentPrivilege 2008 wmic.exe Token: SeRemoteShutdownPrivilege 2008 wmic.exe Token: SeUndockPrivilege 2008 wmic.exe Token: SeManageVolumePrivilege 2008 wmic.exe Token: 33 2008 wmic.exe Token: 34 2008 wmic.exe Token: 35 2008 wmic.exe Token: 36 2008 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4196 wrote to memory of 2008 4196 proxy.exe 89 PID 4196 wrote to memory of 2008 4196 proxy.exe 89