Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 01:40
Behavioral task
behavioral1
Sample
NiggaDrv.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
NiggaDrv.exe
-
Size
229KB
-
MD5
b3b96ea3275dd1f16fea840f735656d9
-
SHA1
2a18b0fb20a8d3361b3744242b7c4939816985b8
-
SHA256
0179d68051bc377127ffe0e983a1498646b746b5ef7ad5a83f6f062a4b9d1f61
-
SHA512
0b016997326d3a324c3733900cbbd69111c2d6d1dcc8e7f349495dda38b8e8481d94a2bdfdc01830429c8eaf169c80525338ef20b133f441fdbd0c8d9c125e5e
-
SSDEEP
6144:lloZMFrIkd8g+EtXHkv/iD4POT1Cg/7I3R0STTKbKb8e1m1j+Yi:noZOL+EP8POT1Cg/7I3R0STTKiUY
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2364-0-0x0000000000870000-0x00000000008B0000-memory.dmp family_umbral behavioral1/memory/2364-2-0x0000000000360000-0x00000000003E0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2364 NiggaDrv.exe Token: SeIncreaseQuotaPrivilege 2724 wmic.exe Token: SeSecurityPrivilege 2724 wmic.exe Token: SeTakeOwnershipPrivilege 2724 wmic.exe Token: SeLoadDriverPrivilege 2724 wmic.exe Token: SeSystemProfilePrivilege 2724 wmic.exe Token: SeSystemtimePrivilege 2724 wmic.exe Token: SeProfSingleProcessPrivilege 2724 wmic.exe Token: SeIncBasePriorityPrivilege 2724 wmic.exe Token: SeCreatePagefilePrivilege 2724 wmic.exe Token: SeBackupPrivilege 2724 wmic.exe Token: SeRestorePrivilege 2724 wmic.exe Token: SeShutdownPrivilege 2724 wmic.exe Token: SeDebugPrivilege 2724 wmic.exe Token: SeSystemEnvironmentPrivilege 2724 wmic.exe Token: SeRemoteShutdownPrivilege 2724 wmic.exe Token: SeUndockPrivilege 2724 wmic.exe Token: SeManageVolumePrivilege 2724 wmic.exe Token: 33 2724 wmic.exe Token: 34 2724 wmic.exe Token: 35 2724 wmic.exe Token: SeIncreaseQuotaPrivilege 2724 wmic.exe Token: SeSecurityPrivilege 2724 wmic.exe Token: SeTakeOwnershipPrivilege 2724 wmic.exe Token: SeLoadDriverPrivilege 2724 wmic.exe Token: SeSystemProfilePrivilege 2724 wmic.exe Token: SeSystemtimePrivilege 2724 wmic.exe Token: SeProfSingleProcessPrivilege 2724 wmic.exe Token: SeIncBasePriorityPrivilege 2724 wmic.exe Token: SeCreatePagefilePrivilege 2724 wmic.exe Token: SeBackupPrivilege 2724 wmic.exe Token: SeRestorePrivilege 2724 wmic.exe Token: SeShutdownPrivilege 2724 wmic.exe Token: SeDebugPrivilege 2724 wmic.exe Token: SeSystemEnvironmentPrivilege 2724 wmic.exe Token: SeRemoteShutdownPrivilege 2724 wmic.exe Token: SeUndockPrivilege 2724 wmic.exe Token: SeManageVolumePrivilege 2724 wmic.exe Token: 33 2724 wmic.exe Token: 34 2724 wmic.exe Token: 35 2724 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2724 2364 NiggaDrv.exe 28 PID 2364 wrote to memory of 2724 2364 NiggaDrv.exe 28 PID 2364 wrote to memory of 2724 2364 NiggaDrv.exe 28