Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-04-2024 16:52
Behavioral task
behavioral1
Sample
ClientBetaNew.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
ClientBetaNew.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
ClientBetaNew.exe
Resource
win10v2004-20240412-en
General
-
Target
ClientBetaNew.exe
-
Size
229KB
-
MD5
e7fca17393a9f4cb9ccb2f65fc2bb214
-
SHA1
cef26fa30e3f68d85ab923beecc0cd0dbfa2a720
-
SHA256
499282fecf90d5dcdf2b01ca4413c37477ec17b6068b43300dfeaefa1fb50978
-
SHA512
303fe673e0d12410010971fb15ae58751948a7e0fb559e97acf5c73df0a7987dc8d423d59ebdfdfee79ef2696795ecf78543dcb74bebf6073a65229a2d24b80a
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD4rzQumkrHM99YW3X2gyb8e1mtzi:foZtL+EP8rzQumkrHM99YW3X23Ie
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral4/memory/2972-0-0x00000118B3B70000-0x00000118B3BB0000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ClientBetaNew.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 discord.com 6 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1632 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 8 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2972 ClientBetaNew.exe 2348 powershell.exe 2348 powershell.exe 4728 powershell.exe 4728 powershell.exe 2408 powershell.exe 2408 powershell.exe 4852 powershell.exe 4852 powershell.exe 1928 powershell.exe 1928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2972 ClientBetaNew.exe Token: SeIncreaseQuotaPrivilege 4676 wmic.exe Token: SeSecurityPrivilege 4676 wmic.exe Token: SeTakeOwnershipPrivilege 4676 wmic.exe Token: SeLoadDriverPrivilege 4676 wmic.exe Token: SeSystemProfilePrivilege 4676 wmic.exe Token: SeSystemtimePrivilege 4676 wmic.exe Token: SeProfSingleProcessPrivilege 4676 wmic.exe Token: SeIncBasePriorityPrivilege 4676 wmic.exe Token: SeCreatePagefilePrivilege 4676 wmic.exe Token: SeBackupPrivilege 4676 wmic.exe Token: SeRestorePrivilege 4676 wmic.exe Token: SeShutdownPrivilege 4676 wmic.exe Token: SeDebugPrivilege 4676 wmic.exe Token: SeSystemEnvironmentPrivilege 4676 wmic.exe Token: SeRemoteShutdownPrivilege 4676 wmic.exe Token: SeUndockPrivilege 4676 wmic.exe Token: SeManageVolumePrivilege 4676 wmic.exe Token: 33 4676 wmic.exe Token: 34 4676 wmic.exe Token: 35 4676 wmic.exe Token: 36 4676 wmic.exe Token: SeIncreaseQuotaPrivilege 4676 wmic.exe Token: SeSecurityPrivilege 4676 wmic.exe Token: SeTakeOwnershipPrivilege 4676 wmic.exe Token: SeLoadDriverPrivilege 4676 wmic.exe Token: SeSystemProfilePrivilege 4676 wmic.exe Token: SeSystemtimePrivilege 4676 wmic.exe Token: SeProfSingleProcessPrivilege 4676 wmic.exe Token: SeIncBasePriorityPrivilege 4676 wmic.exe Token: SeCreatePagefilePrivilege 4676 wmic.exe Token: SeBackupPrivilege 4676 wmic.exe Token: SeRestorePrivilege 4676 wmic.exe Token: SeShutdownPrivilege 4676 wmic.exe Token: SeDebugPrivilege 4676 wmic.exe Token: SeSystemEnvironmentPrivilege 4676 wmic.exe Token: SeRemoteShutdownPrivilege 4676 wmic.exe Token: SeUndockPrivilege 4676 wmic.exe Token: SeManageVolumePrivilege 4676 wmic.exe Token: 33 4676 wmic.exe Token: 34 4676 wmic.exe Token: 35 4676 wmic.exe Token: 36 4676 wmic.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeDebugPrivilege 2408 powershell.exe Token: SeDebugPrivilege 4852 powershell.exe Token: SeIncreaseQuotaPrivilege 1680 wmic.exe Token: SeSecurityPrivilege 1680 wmic.exe Token: SeTakeOwnershipPrivilege 1680 wmic.exe Token: SeLoadDriverPrivilege 1680 wmic.exe Token: SeSystemProfilePrivilege 1680 wmic.exe Token: SeSystemtimePrivilege 1680 wmic.exe Token: SeProfSingleProcessPrivilege 1680 wmic.exe Token: SeIncBasePriorityPrivilege 1680 wmic.exe Token: SeCreatePagefilePrivilege 1680 wmic.exe Token: SeBackupPrivilege 1680 wmic.exe Token: SeRestorePrivilege 1680 wmic.exe Token: SeShutdownPrivilege 1680 wmic.exe Token: SeDebugPrivilege 1680 wmic.exe Token: SeSystemEnvironmentPrivilege 1680 wmic.exe Token: SeRemoteShutdownPrivilege 1680 wmic.exe Token: SeUndockPrivilege 1680 wmic.exe Token: SeManageVolumePrivilege 1680 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4676 2972 ClientBetaNew.exe 80 PID 2972 wrote to memory of 4676 2972 ClientBetaNew.exe 80 PID 2972 wrote to memory of 556 2972 ClientBetaNew.exe 83 PID 2972 wrote to memory of 556 2972 ClientBetaNew.exe 83 PID 2972 wrote to memory of 2348 2972 ClientBetaNew.exe 85 PID 2972 wrote to memory of 2348 2972 ClientBetaNew.exe 85 PID 2972 wrote to memory of 4728 2972 ClientBetaNew.exe 87 PID 2972 wrote to memory of 4728 2972 ClientBetaNew.exe 87 PID 2972 wrote to memory of 2408 2972 ClientBetaNew.exe 90 PID 2972 wrote to memory of 2408 2972 ClientBetaNew.exe 90 PID 2972 wrote to memory of 4852 2972 ClientBetaNew.exe 92 PID 2972 wrote to memory of 4852 2972 ClientBetaNew.exe 92 PID 2972 wrote to memory of 1680 2972 ClientBetaNew.exe 94 PID 2972 wrote to memory of 1680 2972 ClientBetaNew.exe 94 PID 2972 wrote to memory of 416 2972 ClientBetaNew.exe 96 PID 2972 wrote to memory of 416 2972 ClientBetaNew.exe 96 PID 2972 wrote to memory of 3880 2972 ClientBetaNew.exe 98 PID 2972 wrote to memory of 3880 2972 ClientBetaNew.exe 98 PID 2972 wrote to memory of 1928 2972 ClientBetaNew.exe 100 PID 2972 wrote to memory of 1928 2972 ClientBetaNew.exe 100 PID 2972 wrote to memory of 1632 2972 ClientBetaNew.exe 102 PID 2972 wrote to memory of 1632 2972 ClientBetaNew.exe 102 PID 2972 wrote to memory of 2156 2972 ClientBetaNew.exe 104 PID 2972 wrote to memory of 2156 2972 ClientBetaNew.exe 104 PID 2156 wrote to memory of 8 2156 cmd.exe 106 PID 2156 wrote to memory of 8 2156 cmd.exe 106 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 556 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientBetaNew.exe"C:\Users\Admin\AppData\Local\Temp\ClientBetaNew.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\ClientBetaNew.exe"2⤵
- Views/modifies file attributes
PID:556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ClientBetaNew.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:416
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1632
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\ClientBetaNew.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:8
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55ba388a6597d5e09191c2c88d2fdf598
SHA113516f8ec5a99298f6952438055c39330feae5d8
SHA256e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca
SHA512ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19
-
Filesize
944B
MD5687b3558d687becb30ad8f90997723cc
SHA1fb326d7d105aba4d26e1764e73fd124cad23f298
SHA2565283507c63132fdaf5d64bb0a09bcd6ae6d412a4df0be934268bf8e774207ece
SHA512f827d61fad06764cefbca1688b8b2df7c07a1080be42f524de9765650382db84151ee90dd74b6568ea6f5bc582399695ec2c1c598256076f2dc91ff250450abd
-
Filesize
948B
MD56bddc96a32b9ed8fc70b141ccf4a39b2
SHA10f33c0699da40a5eadcec646791cf21cdb0dd7c6
SHA256cb3853abe77eb0da8a1caccb49e97a573b6f35570722eb759116a645d724c132
SHA512e41f1597b4129b759e4199db195df1c24e47cc47dc9850fab2d48e44bc3d37dc3658fbfbb62332a0b93c552587d7fab09de1634f605faa2209b8470c2a6eaca6
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD59db2bc0a0bdfa296036c380393d879e6
SHA1671288bb74f568effac2199c9213cf7e23a31ef9
SHA256cce5cc392ad9a82edd35129076da6bb2c3ebe85e158efef8ee7740e9e722c678
SHA512a1331966d5669c465ccbfbb588d8e09d295aba56be1e0bc895966da28916bdfb2e3333e24f48a54c68f3c3af0f78ec70cea1e07ec2e2647e154d7dfc4d412fc7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82