Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 14:39
Behavioral task
behavioral1
Sample
celex.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
-
Target
celex.exe
-
Size
227KB
-
MD5
f16dec0bdfdb9ae71b1b410c6ed815ec
-
SHA1
10077d4bbc449011fdebc06810fc2196873eaf86
-
SHA256
d94fca1806e2fd56a8d56dd4599ba69f39633a0247b78922773da7504d51cf19
-
SHA512
3b9d0b195eb8348fb44739d9a703228113c9810f50e9d145eaac0e8642dbac9435b593be7f982f4b0c041b6bc635b2b14da5fcba577004e3e25f77a2b7ad071e
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4oAWfecjfUQ1gevPec5/b8e1mPi:IoZtL+EP8oAWfecjfUQ1gevPecNR
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3300-0-0x000001EFCC100000-0x000001EFCC140000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3300 celex.exe Token: SeIncreaseQuotaPrivilege 4824 wmic.exe Token: SeSecurityPrivilege 4824 wmic.exe Token: SeTakeOwnershipPrivilege 4824 wmic.exe Token: SeLoadDriverPrivilege 4824 wmic.exe Token: SeSystemProfilePrivilege 4824 wmic.exe Token: SeSystemtimePrivilege 4824 wmic.exe Token: SeProfSingleProcessPrivilege 4824 wmic.exe Token: SeIncBasePriorityPrivilege 4824 wmic.exe Token: SeCreatePagefilePrivilege 4824 wmic.exe Token: SeBackupPrivilege 4824 wmic.exe Token: SeRestorePrivilege 4824 wmic.exe Token: SeShutdownPrivilege 4824 wmic.exe Token: SeDebugPrivilege 4824 wmic.exe Token: SeSystemEnvironmentPrivilege 4824 wmic.exe Token: SeRemoteShutdownPrivilege 4824 wmic.exe Token: SeUndockPrivilege 4824 wmic.exe Token: SeManageVolumePrivilege 4824 wmic.exe Token: 33 4824 wmic.exe Token: 34 4824 wmic.exe Token: 35 4824 wmic.exe Token: 36 4824 wmic.exe Token: SeIncreaseQuotaPrivilege 4824 wmic.exe Token: SeSecurityPrivilege 4824 wmic.exe Token: SeTakeOwnershipPrivilege 4824 wmic.exe Token: SeLoadDriverPrivilege 4824 wmic.exe Token: SeSystemProfilePrivilege 4824 wmic.exe Token: SeSystemtimePrivilege 4824 wmic.exe Token: SeProfSingleProcessPrivilege 4824 wmic.exe Token: SeIncBasePriorityPrivilege 4824 wmic.exe Token: SeCreatePagefilePrivilege 4824 wmic.exe Token: SeBackupPrivilege 4824 wmic.exe Token: SeRestorePrivilege 4824 wmic.exe Token: SeShutdownPrivilege 4824 wmic.exe Token: SeDebugPrivilege 4824 wmic.exe Token: SeSystemEnvironmentPrivilege 4824 wmic.exe Token: SeRemoteShutdownPrivilege 4824 wmic.exe Token: SeUndockPrivilege 4824 wmic.exe Token: SeManageVolumePrivilege 4824 wmic.exe Token: 33 4824 wmic.exe Token: 34 4824 wmic.exe Token: 35 4824 wmic.exe Token: 36 4824 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3300 wrote to memory of 4824 3300 celex.exe 85 PID 3300 wrote to memory of 4824 3300 celex.exe 85