Resubmissions
31-01-2024 16:29
240131-ty7egagee7 10Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2024 16:29
General
-
Target
Celestial.exe
-
Size
264KB
-
MD5
d448a2df6f29c91c23b0d482fdb6ca49
-
SHA1
e533756132da1916cb3b6217edc066e72497bca3
-
SHA256
6ef6ef99e387801bbcb19f3295f0fa626fd2a0515a8f1947bce5d1f43fa6f968
-
SHA512
b1154c2cefb95e3e43738ac7a589c05482f126d7c325575a4540a100fac2691bd6bbeeb6105b8205132ae48fdbc68da4087a8d728e2529451ea342ae791ce6cf
-
SSDEEP
6144:DloZM+rIkd8g+EtXHkv/iD4rBKjuMzvEHlwOffuA1b8e1mDimV8vpFNEvt:hoZtL+EP8rBKjuMzvEHlwOffuUVm2vpX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2820-0-0x000001881FDC0000-0x000001881FE08000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2820 Celestial.exe Token: SeIncreaseQuotaPrivilege 4104 wmic.exe Token: SeSecurityPrivilege 4104 wmic.exe Token: SeTakeOwnershipPrivilege 4104 wmic.exe Token: SeLoadDriverPrivilege 4104 wmic.exe Token: SeSystemProfilePrivilege 4104 wmic.exe Token: SeSystemtimePrivilege 4104 wmic.exe Token: SeProfSingleProcessPrivilege 4104 wmic.exe Token: SeIncBasePriorityPrivilege 4104 wmic.exe Token: SeCreatePagefilePrivilege 4104 wmic.exe Token: SeBackupPrivilege 4104 wmic.exe Token: SeRestorePrivilege 4104 wmic.exe Token: SeShutdownPrivilege 4104 wmic.exe Token: SeDebugPrivilege 4104 wmic.exe Token: SeSystemEnvironmentPrivilege 4104 wmic.exe Token: SeRemoteShutdownPrivilege 4104 wmic.exe Token: SeUndockPrivilege 4104 wmic.exe Token: SeManageVolumePrivilege 4104 wmic.exe Token: 33 4104 wmic.exe Token: 34 4104 wmic.exe Token: 35 4104 wmic.exe Token: 36 4104 wmic.exe Token: SeIncreaseQuotaPrivilege 4104 wmic.exe Token: SeSecurityPrivilege 4104 wmic.exe Token: SeTakeOwnershipPrivilege 4104 wmic.exe Token: SeLoadDriverPrivilege 4104 wmic.exe Token: SeSystemProfilePrivilege 4104 wmic.exe Token: SeSystemtimePrivilege 4104 wmic.exe Token: SeProfSingleProcessPrivilege 4104 wmic.exe Token: SeIncBasePriorityPrivilege 4104 wmic.exe Token: SeCreatePagefilePrivilege 4104 wmic.exe Token: SeBackupPrivilege 4104 wmic.exe Token: SeRestorePrivilege 4104 wmic.exe Token: SeShutdownPrivilege 4104 wmic.exe Token: SeDebugPrivilege 4104 wmic.exe Token: SeSystemEnvironmentPrivilege 4104 wmic.exe Token: SeRemoteShutdownPrivilege 4104 wmic.exe Token: SeUndockPrivilege 4104 wmic.exe Token: SeManageVolumePrivilege 4104 wmic.exe Token: 33 4104 wmic.exe Token: 34 4104 wmic.exe Token: 35 4104 wmic.exe Token: 36 4104 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4104 2820 Celestial.exe 86 PID 2820 wrote to memory of 4104 2820 Celestial.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1284