Analysis
- max time kernel
93s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 14:39
Behavioral task
behavioral1
Sample
celex.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target celex.exe
- Size 227KB
- Sample240318-r1efcsbg4x
- SHA256 d94fca1806e2fd56a8d56dd4599ba69f39633a0247b78922773da7504d51cf19
- MD5 f16dec0bdfdb9ae71b1b410c6ed815ec
- SHA1 10077d4bbc449011fdebc06810fc2196873eaf86
- SHA512 3b9d0b195eb8348fb44739d9a703228113c9810f50e9d145eaac0e8642dbac9435b593be7f982f4b0c041b6bc635b2b14da5fcba577004e3e25f77a2b7ad071e
- SSDEEP 6144:eloZM+rIkd8g+EtXHkv/iD4oAWfecjfUQ1gevPec5/b8e1mPi:IoZtL+EP8oAWfecjfUQ1gevPecNR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3300-0-0x000001EFCC100000-0x000001EFCC140000-memory.dmp family_umbral - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3300 celex.exe Token: SeIncreaseQuotaPrivilege 4824 wmic.exe Token: SeSecurityPrivilege 4824 wmic.exe Token: SeTakeOwnershipPrivilege 4824 wmic.exe Token: SeLoadDriverPrivilege 4824 wmic.exe Token: SeSystemProfilePrivilege 4824 wmic.exe Token: SeSystemtimePrivilege 4824 wmic.exe Token: SeProfSingleProcessPrivilege 4824 wmic.exe Token: SeIncBasePriorityPrivilege 4824 wmic.exe Token: SeCreatePagefilePrivilege 4824 wmic.exe Token: SeBackupPrivilege 4824 wmic.exe Token: SeRestorePrivilege 4824 wmic.exe Token: SeShutdownPrivilege 4824 wmic.exe Token: SeDebugPrivilege 4824 wmic.exe Token: SeSystemEnvironmentPrivilege 4824 wmic.exe Token: SeRemoteShutdownPrivilege 4824 wmic.exe Token: SeUndockPrivilege 4824 wmic.exe Token: SeManageVolumePrivilege 4824 wmic.exe Token: 33 4824 wmic.exe Token: 34 4824 wmic.exe Token: 35 4824 wmic.exe Token: 36 4824 wmic.exe Token: SeIncreaseQuotaPrivilege 4824 wmic.exe Token: SeSecurityPrivilege 4824 wmic.exe Token: SeTakeOwnershipPrivilege 4824 wmic.exe Token: SeLoadDriverPrivilege 4824 wmic.exe Token: SeSystemProfilePrivilege 4824 wmic.exe Token: SeSystemtimePrivilege 4824 wmic.exe Token: SeProfSingleProcessPrivilege 4824 wmic.exe Token: SeIncBasePriorityPrivilege 4824 wmic.exe Token: SeCreatePagefilePrivilege 4824 wmic.exe Token: SeBackupPrivilege 4824 wmic.exe Token: SeRestorePrivilege 4824 wmic.exe Token: SeShutdownPrivilege 4824 wmic.exe Token: SeDebugPrivilege 4824 wmic.exe Token: SeSystemEnvironmentPrivilege 4824 wmic.exe Token: SeRemoteShutdownPrivilege 4824 wmic.exe Token: SeUndockPrivilege 4824 wmic.exe Token: SeManageVolumePrivilege 4824 wmic.exe Token: 33 4824 wmic.exe Token: 34 4824 wmic.exe Token: 35 4824 wmic.exe Token: 36 4824 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3300 wrote to memory of 4824 3300 celex.exe 85 PID 3300 wrote to memory of 4824 3300 celex.exe 85