Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 09:20
Behavioral task
behavioral1
Sample
primordial loader cracked.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
primordial loader cracked.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
primordialV2.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
primordialV2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
primordial loader cracked.exe
-
Size
229KB
-
MD5
aade2822bd0471da2ed5a068a099fb1b
-
SHA1
39e9fbd333650353aff09f6f0f66a3d1d6dcdd14
-
SHA256
00201eadd8efe516d68a7b736bd3b66635ad9bd5c7ede630bd2a85edf2d3f97d
-
SHA512
0dbb3f78c8034330010bc02053b382489243a69a9a2d179f96b34715acf8b805c824e2efbf13ba870e570138a9aecb3e7696167cd9f264bc4bd750dd3da545dc
-
SSDEEP
6144:7loZM99EBt/SqctonEPfCqArWu/p3cw/3eHp0AVwpJ8e1muf8:ZoZvFSqcwvrWu/p3cw/3eHp0AVCVk
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3628-0-0x000001FA81FF0000-0x000001FA82030000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3628 primordial loader cracked.exe Token: SeIncreaseQuotaPrivilege 1212 wmic.exe Token: SeSecurityPrivilege 1212 wmic.exe Token: SeTakeOwnershipPrivilege 1212 wmic.exe Token: SeLoadDriverPrivilege 1212 wmic.exe Token: SeSystemProfilePrivilege 1212 wmic.exe Token: SeSystemtimePrivilege 1212 wmic.exe Token: SeProfSingleProcessPrivilege 1212 wmic.exe Token: SeIncBasePriorityPrivilege 1212 wmic.exe Token: SeCreatePagefilePrivilege 1212 wmic.exe Token: SeBackupPrivilege 1212 wmic.exe Token: SeRestorePrivilege 1212 wmic.exe Token: SeShutdownPrivilege 1212 wmic.exe Token: SeDebugPrivilege 1212 wmic.exe Token: SeSystemEnvironmentPrivilege 1212 wmic.exe Token: SeRemoteShutdownPrivilege 1212 wmic.exe Token: SeUndockPrivilege 1212 wmic.exe Token: SeManageVolumePrivilege 1212 wmic.exe Token: 33 1212 wmic.exe Token: 34 1212 wmic.exe Token: 35 1212 wmic.exe Token: 36 1212 wmic.exe Token: SeIncreaseQuotaPrivilege 1212 wmic.exe Token: SeSecurityPrivilege 1212 wmic.exe Token: SeTakeOwnershipPrivilege 1212 wmic.exe Token: SeLoadDriverPrivilege 1212 wmic.exe Token: SeSystemProfilePrivilege 1212 wmic.exe Token: SeSystemtimePrivilege 1212 wmic.exe Token: SeProfSingleProcessPrivilege 1212 wmic.exe Token: SeIncBasePriorityPrivilege 1212 wmic.exe Token: SeCreatePagefilePrivilege 1212 wmic.exe Token: SeBackupPrivilege 1212 wmic.exe Token: SeRestorePrivilege 1212 wmic.exe Token: SeShutdownPrivilege 1212 wmic.exe Token: SeDebugPrivilege 1212 wmic.exe Token: SeSystemEnvironmentPrivilege 1212 wmic.exe Token: SeRemoteShutdownPrivilege 1212 wmic.exe Token: SeUndockPrivilege 1212 wmic.exe Token: SeManageVolumePrivilege 1212 wmic.exe Token: 33 1212 wmic.exe Token: 34 1212 wmic.exe Token: 35 1212 wmic.exe Token: 36 1212 wmic.exe Token: SeDebugPrivilege 1628 taskmgr.exe Token: SeSystemProfilePrivilege 1628 taskmgr.exe Token: SeCreateGlobalPrivilege 1628 taskmgr.exe Token: 33 1628 taskmgr.exe Token: SeIncBasePriorityPrivilege 1628 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1212 3628 primordial loader cracked.exe 84 PID 3628 wrote to memory of 1212 3628 primordial loader cracked.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\primordial loader cracked.exe"C:\Users\Admin\AppData\Local\Temp\primordial loader cracked.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1628
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:1516