Analysis
-
max time kernel
1561s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 21:43
Behavioral task
behavioral1
Sample
PeerDistAD.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
1800 seconds
General
-
Target
PeerDistAD.exe
-
Size
229KB
-
MD5
afa8bb7e6708d4b5c056079f642b65f9
-
SHA1
3cadcd7a2da0bc26fd7912f46bdc692e51752913
-
SHA256
9041042642f5c0b67443490fc595aaaa1858c3a8582602969f1af568cad398e9
-
SHA512
46392d04c3827a9f1602685bae2b10a69306839ce3af5b51889a70925e48654e0b8793ae4f68a4ce94f7c7dc71d0d69f0437583417b32cef9619024294351ed4
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4Z/kJ2U7X8+toGnnGr8+cI8e1mAi:noZtL+EP8Z/kJ2U7X8+toGnnGr8S6
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2212-0-0x0000000000B90000-0x0000000000BD0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2212 PeerDistAD.exe Token: SeIncreaseQuotaPrivilege 280 wmic.exe Token: SeSecurityPrivilege 280 wmic.exe Token: SeTakeOwnershipPrivilege 280 wmic.exe Token: SeLoadDriverPrivilege 280 wmic.exe Token: SeSystemProfilePrivilege 280 wmic.exe Token: SeSystemtimePrivilege 280 wmic.exe Token: SeProfSingleProcessPrivilege 280 wmic.exe Token: SeIncBasePriorityPrivilege 280 wmic.exe Token: SeCreatePagefilePrivilege 280 wmic.exe Token: SeBackupPrivilege 280 wmic.exe Token: SeRestorePrivilege 280 wmic.exe Token: SeShutdownPrivilege 280 wmic.exe Token: SeDebugPrivilege 280 wmic.exe Token: SeSystemEnvironmentPrivilege 280 wmic.exe Token: SeRemoteShutdownPrivilege 280 wmic.exe Token: SeUndockPrivilege 280 wmic.exe Token: SeManageVolumePrivilege 280 wmic.exe Token: 33 280 wmic.exe Token: 34 280 wmic.exe Token: 35 280 wmic.exe Token: SeIncreaseQuotaPrivilege 280 wmic.exe Token: SeSecurityPrivilege 280 wmic.exe Token: SeTakeOwnershipPrivilege 280 wmic.exe Token: SeLoadDriverPrivilege 280 wmic.exe Token: SeSystemProfilePrivilege 280 wmic.exe Token: SeSystemtimePrivilege 280 wmic.exe Token: SeProfSingleProcessPrivilege 280 wmic.exe Token: SeIncBasePriorityPrivilege 280 wmic.exe Token: SeCreatePagefilePrivilege 280 wmic.exe Token: SeBackupPrivilege 280 wmic.exe Token: SeRestorePrivilege 280 wmic.exe Token: SeShutdownPrivilege 280 wmic.exe Token: SeDebugPrivilege 280 wmic.exe Token: SeSystemEnvironmentPrivilege 280 wmic.exe Token: SeRemoteShutdownPrivilege 280 wmic.exe Token: SeUndockPrivilege 280 wmic.exe Token: SeManageVolumePrivilege 280 wmic.exe Token: 33 280 wmic.exe Token: 34 280 wmic.exe Token: 35 280 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 280 2212 PeerDistAD.exe 28 PID 2212 wrote to memory of 280 2212 PeerDistAD.exe 28 PID 2212 wrote to memory of 280 2212 PeerDistAD.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe"C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:280
-