Analysis
-
max time kernel
15s -
max time network
24s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-04-2024 10:34
Behavioral task
behavioral1
Sample
pluh/external roblox launcher.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
pluh/external roblox launcher.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
pluh/external roblox launcher.exe
-
Size
229KB
-
MD5
65536dc4bcafc3ee3c1dcf7ed64c12df
-
SHA1
e1ca248ae2ef47a6b89ad6fb155f4d5ec3674e9c
-
SHA256
98e7e144b7bc45bd52601d093b1e447cf486bf2e8cd2ba84e8325e2d7b269662
-
SHA512
25f5043750e42d312b879dcb1b37bc4621790f7402befa21578818c8de6020f1983a984bde79eeaca60b3cd12654fe2dae6e728826e0c4da3794be3519d3bcc2
-
SSDEEP
6144:OwloZM3fsXtioRkts/cnnK6cMlkCanywvrY8hkijD6yBeb8e1mvpi:PoZ1tlRk83MlkCanywvrY8hkijD6yQiw
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/224-0-0x000001DD78060000-0x000001DD780A0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 224 external roblox launcher.exe Token: SeIncreaseQuotaPrivilege 872 wmic.exe Token: SeSecurityPrivilege 872 wmic.exe Token: SeTakeOwnershipPrivilege 872 wmic.exe Token: SeLoadDriverPrivilege 872 wmic.exe Token: SeSystemProfilePrivilege 872 wmic.exe Token: SeSystemtimePrivilege 872 wmic.exe Token: SeProfSingleProcessPrivilege 872 wmic.exe Token: SeIncBasePriorityPrivilege 872 wmic.exe Token: SeCreatePagefilePrivilege 872 wmic.exe Token: SeBackupPrivilege 872 wmic.exe Token: SeRestorePrivilege 872 wmic.exe Token: SeShutdownPrivilege 872 wmic.exe Token: SeDebugPrivilege 872 wmic.exe Token: SeSystemEnvironmentPrivilege 872 wmic.exe Token: SeRemoteShutdownPrivilege 872 wmic.exe Token: SeUndockPrivilege 872 wmic.exe Token: SeManageVolumePrivilege 872 wmic.exe Token: 33 872 wmic.exe Token: 34 872 wmic.exe Token: 35 872 wmic.exe Token: 36 872 wmic.exe Token: SeIncreaseQuotaPrivilege 872 wmic.exe Token: SeSecurityPrivilege 872 wmic.exe Token: SeTakeOwnershipPrivilege 872 wmic.exe Token: SeLoadDriverPrivilege 872 wmic.exe Token: SeSystemProfilePrivilege 872 wmic.exe Token: SeSystemtimePrivilege 872 wmic.exe Token: SeProfSingleProcessPrivilege 872 wmic.exe Token: SeIncBasePriorityPrivilege 872 wmic.exe Token: SeCreatePagefilePrivilege 872 wmic.exe Token: SeBackupPrivilege 872 wmic.exe Token: SeRestorePrivilege 872 wmic.exe Token: SeShutdownPrivilege 872 wmic.exe Token: SeDebugPrivilege 872 wmic.exe Token: SeSystemEnvironmentPrivilege 872 wmic.exe Token: SeRemoteShutdownPrivilege 872 wmic.exe Token: SeUndockPrivilege 872 wmic.exe Token: SeManageVolumePrivilege 872 wmic.exe Token: 33 872 wmic.exe Token: 34 872 wmic.exe Token: 35 872 wmic.exe Token: 36 872 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 224 wrote to memory of 872 224 external roblox launcher.exe 72 PID 224 wrote to memory of 872 224 external roblox launcher.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\pluh\external roblox launcher.exe"C:\Users\Admin\AppData\Local\Temp\pluh\external roblox launcher.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:872
-