Analysis
-
max time kernel
43s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 14:09
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
609KB
-
MD5
9893f79d958d0fdf80c2f87fa526696c
-
SHA1
b5349594b66680de00dd1c64e8ad23f5b60bedec
-
SHA256
6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87
-
SHA512
e0eb174f7b0f8e83c9010836bba865cb2320d94c87939f9ec18a1f029bc5eb1baa8691d25c84ed9cf330c4d6f61e627fb2b01393934f38853f44eacea9110e9e
-
SSDEEP
12288:EoZcL+EP8LhahecjfUn1gevPeVTv6iPVle8w15dQPvY:HI8dahecjfUn1gevPeV7s15uY
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2300-10-0x0000000000400000-0x00000000004A0000-memory.dmp family_umbral -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation Loader.exe -
Executes dropped EXE 1 IoCs
pid Process 3492 Java(TM) Platform SE binary.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3388 taskmgr.exe Token: SeSystemProfilePrivilege 3388 taskmgr.exe Token: SeCreateGlobalPrivilege 3388 taskmgr.exe Token: 33 3388 taskmgr.exe Token: SeIncBasePriorityPrivilege 3388 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3492 2300 Loader.exe 89 PID 2300 wrote to memory of 3492 2300 Loader.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe"C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE binary.exe"2⤵
- Executes dropped EXE
PID:3492
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5c25915f16c086d12c8eb256280e54c96
SHA13166757e19b289aa60a628bc199c4aedcdbb021e
SHA2566d73cb7547926091d83c99452681203ed83369d58029d688702e2291065ab067
SHA5124a066f363410546b1e9934dc74a91f1708c1bcc3121a79b6196ff2c8c43c4a14ba893df8c362dbb3cfc2645dc00059b7c458bf0fe8c8b13792753724cfe2e68b