Analysis
- max time kernel
130s - max time network
139s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system - submitted
04/04/2024, 06:38
Behavioral task
behavioral1
Sample
injector.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
- Target injector.exe
- Size 231KB
- Sample240404-hejcrahc52
- SHA256 03f17e9278c35e4456f926a740d9590a140017b0173f8bc3b7eda7902bcc0e05
- MD5 011dc48d3b07ca3ab0021bfbb2bd0544
- SHA1 1a989adcd1a5385927e4c8ce564e7dafe156300a
- SHA512 83a337abe760652f45e1c16291191e2cefa4f681e084d67b8224e7f86c724fbf748c648e03ca1d8791db8b198d9f21e488b66500e4e2fea56a6806b8bb95a465
- SSDEEP 6144:RloZM9rIkd8g+EtXHkv/iD4SxUVp3cw/FeHp0AV+Rb8e1mQVyi:joZmL+EP8SxUVp3cw/FeHp0AVa1Vn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3848-0-0x0000014BA42F0000-0x0000014BA4330000-memory.dmp family_umbral - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3848 injector.exe Token: SeIncreaseQuotaPrivilege 3276 wmic.exe Token: SeSecurityPrivilege 3276 wmic.exe Token: SeTakeOwnershipPrivilege 3276 wmic.exe Token: SeLoadDriverPrivilege 3276 wmic.exe Token: SeSystemProfilePrivilege 3276 wmic.exe Token: SeSystemtimePrivilege 3276 wmic.exe Token: SeProfSingleProcessPrivilege 3276 wmic.exe Token: SeIncBasePriorityPrivilege 3276 wmic.exe Token: SeCreatePagefilePrivilege 3276 wmic.exe Token: SeBackupPrivilege 3276 wmic.exe Token: SeRestorePrivilege 3276 wmic.exe Token: SeShutdownPrivilege 3276 wmic.exe Token: SeDebugPrivilege 3276 wmic.exe Token: SeSystemEnvironmentPrivilege 3276 wmic.exe Token: SeRemoteShutdownPrivilege 3276 wmic.exe Token: SeUndockPrivilege 3276 wmic.exe Token: SeManageVolumePrivilege 3276 wmic.exe Token: 33 3276 wmic.exe Token: 34 3276 wmic.exe Token: 35 3276 wmic.exe Token: 36 3276 wmic.exe Token: SeIncreaseQuotaPrivilege 3276 wmic.exe Token: SeSecurityPrivilege 3276 wmic.exe Token: SeTakeOwnershipPrivilege 3276 wmic.exe Token: SeLoadDriverPrivilege 3276 wmic.exe Token: SeSystemProfilePrivilege 3276 wmic.exe Token: SeSystemtimePrivilege 3276 wmic.exe Token: SeProfSingleProcessPrivilege 3276 wmic.exe Token: SeIncBasePriorityPrivilege 3276 wmic.exe Token: SeCreatePagefilePrivilege 3276 wmic.exe Token: SeBackupPrivilege 3276 wmic.exe Token: SeRestorePrivilege 3276 wmic.exe Token: SeShutdownPrivilege 3276 wmic.exe Token: SeDebugPrivilege 3276 wmic.exe Token: SeSystemEnvironmentPrivilege 3276 wmic.exe Token: SeRemoteShutdownPrivilege 3276 wmic.exe Token: SeUndockPrivilege 3276 wmic.exe Token: SeManageVolumePrivilege 3276 wmic.exe Token: 33 3276 wmic.exe Token: 34 3276 wmic.exe Token: 35 3276 wmic.exe Token: 36 3276 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3848 wrote to memory of 3276 3848 injector.exe 73 PID 3848 wrote to memory of 3276 3848 injector.exe 73