Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 14:27
Behavioral task
behavioral1
Sample
NiggaDrv.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
NiggaDrv.exe
-
Size
229KB
-
MD5
b3b96ea3275dd1f16fea840f735656d9
-
SHA1
2a18b0fb20a8d3361b3744242b7c4939816985b8
-
SHA256
0179d68051bc377127ffe0e983a1498646b746b5ef7ad5a83f6f062a4b9d1f61
-
SHA512
0b016997326d3a324c3733900cbbd69111c2d6d1dcc8e7f349495dda38b8e8481d94a2bdfdc01830429c8eaf169c80525338ef20b133f441fdbd0c8d9c125e5e
-
SSDEEP
6144:lloZMFrIkd8g+EtXHkv/iD4POT1Cg/7I3R0STTKbKb8e1m1j+Yi:noZOL+EP8POT1Cg/7I3R0STTKiUY
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2528-0-0x0000000000BE0000-0x0000000000C20000-memory.dmp family_umbral behavioral1/memory/2528-2-0x000000001B080000-0x000000001B100000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2528 NiggaDrv.exe Token: SeIncreaseQuotaPrivilege 2696 wmic.exe Token: SeSecurityPrivilege 2696 wmic.exe Token: SeTakeOwnershipPrivilege 2696 wmic.exe Token: SeLoadDriverPrivilege 2696 wmic.exe Token: SeSystemProfilePrivilege 2696 wmic.exe Token: SeSystemtimePrivilege 2696 wmic.exe Token: SeProfSingleProcessPrivilege 2696 wmic.exe Token: SeIncBasePriorityPrivilege 2696 wmic.exe Token: SeCreatePagefilePrivilege 2696 wmic.exe Token: SeBackupPrivilege 2696 wmic.exe Token: SeRestorePrivilege 2696 wmic.exe Token: SeShutdownPrivilege 2696 wmic.exe Token: SeDebugPrivilege 2696 wmic.exe Token: SeSystemEnvironmentPrivilege 2696 wmic.exe Token: SeRemoteShutdownPrivilege 2696 wmic.exe Token: SeUndockPrivilege 2696 wmic.exe Token: SeManageVolumePrivilege 2696 wmic.exe Token: 33 2696 wmic.exe Token: 34 2696 wmic.exe Token: 35 2696 wmic.exe Token: SeIncreaseQuotaPrivilege 2696 wmic.exe Token: SeSecurityPrivilege 2696 wmic.exe Token: SeTakeOwnershipPrivilege 2696 wmic.exe Token: SeLoadDriverPrivilege 2696 wmic.exe Token: SeSystemProfilePrivilege 2696 wmic.exe Token: SeSystemtimePrivilege 2696 wmic.exe Token: SeProfSingleProcessPrivilege 2696 wmic.exe Token: SeIncBasePriorityPrivilege 2696 wmic.exe Token: SeCreatePagefilePrivilege 2696 wmic.exe Token: SeBackupPrivilege 2696 wmic.exe Token: SeRestorePrivilege 2696 wmic.exe Token: SeShutdownPrivilege 2696 wmic.exe Token: SeDebugPrivilege 2696 wmic.exe Token: SeSystemEnvironmentPrivilege 2696 wmic.exe Token: SeRemoteShutdownPrivilege 2696 wmic.exe Token: SeUndockPrivilege 2696 wmic.exe Token: SeManageVolumePrivilege 2696 wmic.exe Token: 33 2696 wmic.exe Token: 34 2696 wmic.exe Token: 35 2696 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2696 2528 NiggaDrv.exe 27 PID 2528 wrote to memory of 2696 2528 NiggaDrv.exe 27 PID 2528 wrote to memory of 2696 2528 NiggaDrv.exe 27