Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2024 16:35
General
-
Target
Celestial.exe
-
Size
264KB
-
MD5
d448a2df6f29c91c23b0d482fdb6ca49
-
SHA1
e533756132da1916cb3b6217edc066e72497bca3
-
SHA256
6ef6ef99e387801bbcb19f3295f0fa626fd2a0515a8f1947bce5d1f43fa6f968
-
SHA512
b1154c2cefb95e3e43738ac7a589c05482f126d7c325575a4540a100fac2691bd6bbeeb6105b8205132ae48fdbc68da4087a8d728e2529451ea342ae791ce6cf
-
SSDEEP
6144:DloZM+rIkd8g+EtXHkv/iD4rBKjuMzvEHlwOffuA1b8e1mDimV8vpFNEvt:hoZtL+EP8rBKjuMzvEHlwOffuUVm2vpX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4748-0-0x000001F2D88B0000-0x000001F2D88F8000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4748 Celestial.exe Token: SeIncreaseQuotaPrivilege 4100 wmic.exe Token: SeSecurityPrivilege 4100 wmic.exe Token: SeTakeOwnershipPrivilege 4100 wmic.exe Token: SeLoadDriverPrivilege 4100 wmic.exe Token: SeSystemProfilePrivilege 4100 wmic.exe Token: SeSystemtimePrivilege 4100 wmic.exe Token: SeProfSingleProcessPrivilege 4100 wmic.exe Token: SeIncBasePriorityPrivilege 4100 wmic.exe Token: SeCreatePagefilePrivilege 4100 wmic.exe Token: SeBackupPrivilege 4100 wmic.exe Token: SeRestorePrivilege 4100 wmic.exe Token: SeShutdownPrivilege 4100 wmic.exe Token: SeDebugPrivilege 4100 wmic.exe Token: SeSystemEnvironmentPrivilege 4100 wmic.exe Token: SeRemoteShutdownPrivilege 4100 wmic.exe Token: SeUndockPrivilege 4100 wmic.exe Token: SeManageVolumePrivilege 4100 wmic.exe Token: 33 4100 wmic.exe Token: 34 4100 wmic.exe Token: 35 4100 wmic.exe Token: 36 4100 wmic.exe Token: SeIncreaseQuotaPrivilege 4100 wmic.exe Token: SeSecurityPrivilege 4100 wmic.exe Token: SeTakeOwnershipPrivilege 4100 wmic.exe Token: SeLoadDriverPrivilege 4100 wmic.exe Token: SeSystemProfilePrivilege 4100 wmic.exe Token: SeSystemtimePrivilege 4100 wmic.exe Token: SeProfSingleProcessPrivilege 4100 wmic.exe Token: SeIncBasePriorityPrivilege 4100 wmic.exe Token: SeCreatePagefilePrivilege 4100 wmic.exe Token: SeBackupPrivilege 4100 wmic.exe Token: SeRestorePrivilege 4100 wmic.exe Token: SeShutdownPrivilege 4100 wmic.exe Token: SeDebugPrivilege 4100 wmic.exe Token: SeSystemEnvironmentPrivilege 4100 wmic.exe Token: SeRemoteShutdownPrivilege 4100 wmic.exe Token: SeUndockPrivilege 4100 wmic.exe Token: SeManageVolumePrivilege 4100 wmic.exe Token: 33 4100 wmic.exe Token: 34 4100 wmic.exe Token: 35 4100 wmic.exe Token: 36 4100 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4748 wrote to memory of 4100 4748 Celestial.exe 87 PID 4748 wrote to memory of 4100 4748 Celestial.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2096