Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 18:58
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
229KB
-
MD5
7d3ec891ac80ae5fbbf0366e5b4ea702
-
SHA1
344763c3be81c43ee0e0e0022242b550b5e1a0b3
-
SHA256
843af731d37eb2dcf935d99b426f6aa4068f6e53707dc5ed82bc40670e9f59a4
-
SHA512
c07ad66d8ac875fa4e13f4c826963271bd6b5e090e44f371ae5bdb05e454c733a1286679dc9ce2151790de8ad0916040f402a6eff9709052878ea3dbc6aa9375
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4zHUkecjfUh1gevPeOsb8e1mSi:noZtL+EP8zHUkecjfUh1gevPe7I
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2944-0-0x0000000000A80000-0x0000000000AC0000-memory.dmp family_umbral behavioral1/memory/2944-2-0x000000001B310000-0x000000001B390000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2944 Loader.exe Token: SeIncreaseQuotaPrivilege 2928 wmic.exe Token: SeSecurityPrivilege 2928 wmic.exe Token: SeTakeOwnershipPrivilege 2928 wmic.exe Token: SeLoadDriverPrivilege 2928 wmic.exe Token: SeSystemProfilePrivilege 2928 wmic.exe Token: SeSystemtimePrivilege 2928 wmic.exe Token: SeProfSingleProcessPrivilege 2928 wmic.exe Token: SeIncBasePriorityPrivilege 2928 wmic.exe Token: SeCreatePagefilePrivilege 2928 wmic.exe Token: SeBackupPrivilege 2928 wmic.exe Token: SeRestorePrivilege 2928 wmic.exe Token: SeShutdownPrivilege 2928 wmic.exe Token: SeDebugPrivilege 2928 wmic.exe Token: SeSystemEnvironmentPrivilege 2928 wmic.exe Token: SeRemoteShutdownPrivilege 2928 wmic.exe Token: SeUndockPrivilege 2928 wmic.exe Token: SeManageVolumePrivilege 2928 wmic.exe Token: 33 2928 wmic.exe Token: 34 2928 wmic.exe Token: 35 2928 wmic.exe Token: SeIncreaseQuotaPrivilege 2928 wmic.exe Token: SeSecurityPrivilege 2928 wmic.exe Token: SeTakeOwnershipPrivilege 2928 wmic.exe Token: SeLoadDriverPrivilege 2928 wmic.exe Token: SeSystemProfilePrivilege 2928 wmic.exe Token: SeSystemtimePrivilege 2928 wmic.exe Token: SeProfSingleProcessPrivilege 2928 wmic.exe Token: SeIncBasePriorityPrivilege 2928 wmic.exe Token: SeCreatePagefilePrivilege 2928 wmic.exe Token: SeBackupPrivilege 2928 wmic.exe Token: SeRestorePrivilege 2928 wmic.exe Token: SeShutdownPrivilege 2928 wmic.exe Token: SeDebugPrivilege 2928 wmic.exe Token: SeSystemEnvironmentPrivilege 2928 wmic.exe Token: SeRemoteShutdownPrivilege 2928 wmic.exe Token: SeUndockPrivilege 2928 wmic.exe Token: SeManageVolumePrivilege 2928 wmic.exe Token: 33 2928 wmic.exe Token: 34 2928 wmic.exe Token: 35 2928 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2928 2944 Loader.exe 30 PID 2944 wrote to memory of 2928 2944 Loader.exe 30 PID 2944 wrote to memory of 2928 2944 Loader.exe 30