Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 21:08
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
loader.exe
-
Size
231KB
-
MD5
c534087d8b0da713f69ff7674465bb17
-
SHA1
f2ecb66437aa0ec06cce908428b6b891aed74071
-
SHA256
9bfbe65dc852646119cde7e50ba948d7fae6d80f2bc6483273478f398a726f97
-
SHA512
f7165e561a0f76b524e3db552e09caf44f3ef5200934e5de45163df386a0d769674148e741107acf5b92aa4b9e34c54cc5582d955da3892dc5986aef51bf4815
-
SSDEEP
6144:xloZMArIkd8g+EtXHkv/iD434SD34QWRJ6KyvSgR1EPab8e1m0i:DoZHL+EP8oE34QWRJ63vSgR1E+m
Malware Config
Extracted
Family
umbral
C2
https://discord.com/api/webhooks/1216116533479346246/GCn9E-FI2n_nCpNoEWOQeSmsFZHsV_6zisdplLLN7TeuZDUQAAOT92vHBBSjr3uvmeYM
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/memory/2532-0-0x000001AA7D2A0000-0x000001AA7D2E0000-memory.dmp family_umbral behavioral2/files/0x000b0000000231f0-118.dat family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts loader.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 discord.com 13 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2836 wmic.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4124 powershell.exe 4124 powershell.exe 4060 powershell.exe 4060 powershell.exe 1536 powershell.exe 1536 powershell.exe 3196 powershell.exe 3196 powershell.exe 4224 powershell.exe 4224 powershell.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1040 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2532 loader.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 1536 powershell.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeIncreaseQuotaPrivilege 4696 wmic.exe Token: SeSecurityPrivilege 4696 wmic.exe Token: SeTakeOwnershipPrivilege 4696 wmic.exe Token: SeLoadDriverPrivilege 4696 wmic.exe Token: SeSystemProfilePrivilege 4696 wmic.exe Token: SeSystemtimePrivilege 4696 wmic.exe Token: SeProfSingleProcessPrivilege 4696 wmic.exe Token: SeIncBasePriorityPrivilege 4696 wmic.exe Token: SeCreatePagefilePrivilege 4696 wmic.exe Token: SeBackupPrivilege 4696 wmic.exe Token: SeRestorePrivilege 4696 wmic.exe Token: SeShutdownPrivilege 4696 wmic.exe Token: SeDebugPrivilege 4696 wmic.exe Token: SeSystemEnvironmentPrivilege 4696 wmic.exe Token: SeRemoteShutdownPrivilege 4696 wmic.exe Token: SeUndockPrivilege 4696 wmic.exe Token: SeManageVolumePrivilege 4696 wmic.exe Token: 33 4696 wmic.exe Token: 34 4696 wmic.exe Token: 35 4696 wmic.exe Token: 36 4696 wmic.exe Token: SeIncreaseQuotaPrivilege 4696 wmic.exe Token: SeSecurityPrivilege 4696 wmic.exe Token: SeTakeOwnershipPrivilege 4696 wmic.exe Token: SeLoadDriverPrivilege 4696 wmic.exe Token: SeSystemProfilePrivilege 4696 wmic.exe Token: SeSystemtimePrivilege 4696 wmic.exe Token: SeProfSingleProcessPrivilege 4696 wmic.exe Token: SeIncBasePriorityPrivilege 4696 wmic.exe Token: SeCreatePagefilePrivilege 4696 wmic.exe Token: SeBackupPrivilege 4696 wmic.exe Token: SeRestorePrivilege 4696 wmic.exe Token: SeShutdownPrivilege 4696 wmic.exe Token: SeDebugPrivilege 4696 wmic.exe Token: SeSystemEnvironmentPrivilege 4696 wmic.exe Token: SeRemoteShutdownPrivilege 4696 wmic.exe Token: SeUndockPrivilege 4696 wmic.exe Token: SeManageVolumePrivilege 4696 wmic.exe Token: 33 4696 wmic.exe Token: 34 4696 wmic.exe Token: 35 4696 wmic.exe Token: 36 4696 wmic.exe Token: SeIncreaseQuotaPrivilege 4992 wmic.exe Token: SeSecurityPrivilege 4992 wmic.exe Token: SeTakeOwnershipPrivilege 4992 wmic.exe Token: SeLoadDriverPrivilege 4992 wmic.exe Token: SeSystemProfilePrivilege 4992 wmic.exe Token: SeSystemtimePrivilege 4992 wmic.exe Token: SeProfSingleProcessPrivilege 4992 wmic.exe Token: SeIncBasePriorityPrivilege 4992 wmic.exe Token: SeCreatePagefilePrivilege 4992 wmic.exe Token: SeBackupPrivilege 4992 wmic.exe Token: SeRestorePrivilege 4992 wmic.exe Token: SeShutdownPrivilege 4992 wmic.exe Token: SeDebugPrivilege 4992 wmic.exe Token: SeSystemEnvironmentPrivilege 4992 wmic.exe Token: SeRemoteShutdownPrivilege 4992 wmic.exe Token: SeUndockPrivilege 4992 wmic.exe Token: SeManageVolumePrivilege 4992 wmic.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2532 wrote to memory of 4124 2532 loader.exe 85 PID 2532 wrote to memory of 4124 2532 loader.exe 85 PID 2532 wrote to memory of 4060 2532 loader.exe 87 PID 2532 wrote to memory of 4060 2532 loader.exe 87 PID 2532 wrote to memory of 1536 2532 loader.exe 89 PID 2532 wrote to memory of 1536 2532 loader.exe 89 PID 2532 wrote to memory of 3196 2532 loader.exe 91 PID 2532 wrote to memory of 3196 2532 loader.exe 91 PID 2532 wrote to memory of 4696 2532 loader.exe 93 PID 2532 wrote to memory of 4696 2532 loader.exe 93 PID 2532 wrote to memory of 4992 2532 loader.exe 96 PID 2532 wrote to memory of 4992 2532 loader.exe 96 PID 2532 wrote to memory of 1288 2532 loader.exe 98 PID 2532 wrote to memory of 1288 2532 loader.exe 98 PID 2532 wrote to memory of 4224 2532 loader.exe 100 PID 2532 wrote to memory of 4224 2532 loader.exe 100 PID 2532 wrote to memory of 2836 2532 loader.exe 102 PID 2532 wrote to memory of 2836 2532 loader.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2836
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5c534087d8b0da713f69ff7674465bb17
SHA1f2ecb66437aa0ec06cce908428b6b891aed74071
SHA2569bfbe65dc852646119cde7e50ba948d7fae6d80f2bc6483273478f398a726f97
SHA512f7165e561a0f76b524e3db552e09caf44f3ef5200934e5de45163df386a0d769674148e741107acf5b92aa4b9e34c54cc5582d955da3892dc5986aef51bf4815
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
948B
MD517d8127be94d3c1b6fcc9a4ed585003e
SHA1789874fcc7c778c723f3e89822d8cc8750c6c4c8
SHA256ea357ad1f95863b3618d31e5b0f90495331f64de2b784d9e185b48668c937a7b
SHA512bb18b6d07d82227f5cfbe3eb460df79ec892c560ad2964dcd4782aa26336ae15059843bf46a739bdd4a4daa58057f99102531a756a1cf434ce6449b3cd35a98e
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD56317adf4fbc43ea2fd68861fafd57155
SHA16b87c718893c83c6eed2767e8d9cbc6443e31913
SHA256c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af
SHA51217229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82