Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 18:41
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
609KB
-
MD5
9893f79d958d0fdf80c2f87fa526696c
-
SHA1
b5349594b66680de00dd1c64e8ad23f5b60bedec
-
SHA256
6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87
-
SHA512
e0eb174f7b0f8e83c9010836bba865cb2320d94c87939f9ec18a1f029bc5eb1baa8691d25c84ed9cf330c4d6f61e627fb2b01393934f38853f44eacea9110e9e
-
SSDEEP
12288:EoZcL+EP8LhahecjfUn1gevPeVTv6iPVle8w15dQPvY:HI8dahecjfUn1gevPeV7s15uY
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3020-11-0x0000000000400000-0x00000000004A0000-memory.dmp family_umbral -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\Control Panel\International\Geo\Nation Loader.exe -
Executes dropped EXE 1 IoCs
pid Process 3860 Java(TM) Platform SE binary.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 456 taskmgr.exe Token: SeSystemProfilePrivilege 456 taskmgr.exe Token: SeCreateGlobalPrivilege 456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3860 3020 Loader.exe 91 PID 3020 wrote to memory of 3860 3020 Loader.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe"C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe"2⤵
- Executes dropped EXE
PID:3860
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:456
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5c25915f16c086d12c8eb256280e54c96
SHA13166757e19b289aa60a628bc199c4aedcdbb021e
SHA2566d73cb7547926091d83c99452681203ed83369d58029d688702e2291065ab067
SHA5124a066f363410546b1e9934dc74a91f1708c1bcc3121a79b6196ff2c8c43c4a14ba893df8c362dbb3cfc2645dc00059b7c458bf0fe8c8b13792753724cfe2e68b