Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 10:21
Behavioral task
behavioral1
Sample
Celestial Crack.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Celestial Crack.exe
-
Size
231KB
-
MD5
a9a5f4d1c6b608f2e6de17b036685865
-
SHA1
c0b6579327fc42654822e8afe5c8cbc1b5b1ba58
-
SHA256
b9a85b2cf041ab3a6966291f670a076c363b994f9a52de7e94edd5b80020ab92
-
SHA512
a3961fce1edc8c7b267c7e9375ae1a48897bd989c700876e214ee3847a8f14f158a664c4839290b2ad678beb203fb6e92162473b76777ee7d9da58697ce1a66c
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4lMPTaL7N8e1mCKi:joZtL+EP8euBt
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2824-0-0x000001C626650000-0x000001C626690000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2824 Celestial Crack.exe Token: SeIncreaseQuotaPrivilege 1168 wmic.exe Token: SeSecurityPrivilege 1168 wmic.exe Token: SeTakeOwnershipPrivilege 1168 wmic.exe Token: SeLoadDriverPrivilege 1168 wmic.exe Token: SeSystemProfilePrivilege 1168 wmic.exe Token: SeSystemtimePrivilege 1168 wmic.exe Token: SeProfSingleProcessPrivilege 1168 wmic.exe Token: SeIncBasePriorityPrivilege 1168 wmic.exe Token: SeCreatePagefilePrivilege 1168 wmic.exe Token: SeBackupPrivilege 1168 wmic.exe Token: SeRestorePrivilege 1168 wmic.exe Token: SeShutdownPrivilege 1168 wmic.exe Token: SeDebugPrivilege 1168 wmic.exe Token: SeSystemEnvironmentPrivilege 1168 wmic.exe Token: SeRemoteShutdownPrivilege 1168 wmic.exe Token: SeUndockPrivilege 1168 wmic.exe Token: SeManageVolumePrivilege 1168 wmic.exe Token: 33 1168 wmic.exe Token: 34 1168 wmic.exe Token: 35 1168 wmic.exe Token: 36 1168 wmic.exe Token: SeIncreaseQuotaPrivilege 1168 wmic.exe Token: SeSecurityPrivilege 1168 wmic.exe Token: SeTakeOwnershipPrivilege 1168 wmic.exe Token: SeLoadDriverPrivilege 1168 wmic.exe Token: SeSystemProfilePrivilege 1168 wmic.exe Token: SeSystemtimePrivilege 1168 wmic.exe Token: SeProfSingleProcessPrivilege 1168 wmic.exe Token: SeIncBasePriorityPrivilege 1168 wmic.exe Token: SeCreatePagefilePrivilege 1168 wmic.exe Token: SeBackupPrivilege 1168 wmic.exe Token: SeRestorePrivilege 1168 wmic.exe Token: SeShutdownPrivilege 1168 wmic.exe Token: SeDebugPrivilege 1168 wmic.exe Token: SeSystemEnvironmentPrivilege 1168 wmic.exe Token: SeRemoteShutdownPrivilege 1168 wmic.exe Token: SeUndockPrivilege 1168 wmic.exe Token: SeManageVolumePrivilege 1168 wmic.exe Token: 33 1168 wmic.exe Token: 34 1168 wmic.exe Token: 35 1168 wmic.exe Token: 36 1168 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2824 wrote to memory of 1168 2824 Celestial Crack.exe 79 PID 2824 wrote to memory of 1168 2824 Celestial Crack.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial Crack.exe"C:\Users\Admin\AppData\Local\Temp\Celestial Crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-