Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-04-2024 04:39
Behavioral task
behavioral1
Sample
mechanica.exe
Resource
win10-20240404-en
General
-
Target
mechanica.exe
-
Size
235KB
-
MD5
c0e8a2ef061d2da5952f7012a2284150
-
SHA1
820e883e45b719c5408b557ddb68435f72587876
-
SHA256
735ce0dc54202d20fe97e8849619dcbdb676263f702176f538059926f98a8054
-
SHA512
bcf5da34b1a480311d84de187401163500a6a93c06f569713429c8230421ef39121824fbaa25d97fecb3fedcafc161f0a31c94ce1f4aba02ed830d937ef8bb1c
-
SSDEEP
6144:zloZM+rIkd8g+EtXHkv/iD4rXcqAmB5K5/Cwhl0Ktb8e1mO6i:xoZtL+EP8rXcqAmB5K5/Cwhl0Ov
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3936-0-0x000002DAAE900000-0x000002DAAE940000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts mechanica.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 discord.com 6 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1548 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4884 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3936 mechanica.exe 3332 powershell.exe 3332 powershell.exe 2256 powershell.exe 2256 powershell.exe 3724 powershell.exe 3724 powershell.exe 2068 powershell.exe 2068 powershell.exe 2776 powershell.exe 2776 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3936 mechanica.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeDebugPrivilege 3332 powershell.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 3724 powershell.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeIncreaseQuotaPrivilege 3348 wmic.exe Token: SeSecurityPrivilege 3348 wmic.exe Token: SeTakeOwnershipPrivilege 3348 wmic.exe Token: SeLoadDriverPrivilege 3348 wmic.exe Token: SeSystemProfilePrivilege 3348 wmic.exe Token: SeSystemtimePrivilege 3348 wmic.exe Token: SeProfSingleProcessPrivilege 3348 wmic.exe Token: SeIncBasePriorityPrivilege 3348 wmic.exe Token: SeCreatePagefilePrivilege 3348 wmic.exe Token: SeBackupPrivilege 3348 wmic.exe Token: SeRestorePrivilege 3348 wmic.exe Token: SeShutdownPrivilege 3348 wmic.exe Token: SeDebugPrivilege 3348 wmic.exe Token: SeSystemEnvironmentPrivilege 3348 wmic.exe Token: SeRemoteShutdownPrivilege 3348 wmic.exe Token: SeUndockPrivilege 3348 wmic.exe Token: SeManageVolumePrivilege 3348 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3936 wrote to memory of 3564 3936 mechanica.exe 81 PID 3936 wrote to memory of 3564 3936 mechanica.exe 81 PID 3936 wrote to memory of 3868 3936 mechanica.exe 84 PID 3936 wrote to memory of 3868 3936 mechanica.exe 84 PID 3936 wrote to memory of 3332 3936 mechanica.exe 86 PID 3936 wrote to memory of 3332 3936 mechanica.exe 86 PID 3936 wrote to memory of 2256 3936 mechanica.exe 88 PID 3936 wrote to memory of 2256 3936 mechanica.exe 88 PID 3936 wrote to memory of 3724 3936 mechanica.exe 90 PID 3936 wrote to memory of 3724 3936 mechanica.exe 90 PID 3936 wrote to memory of 2068 3936 mechanica.exe 92 PID 3936 wrote to memory of 2068 3936 mechanica.exe 92 PID 3936 wrote to memory of 3348 3936 mechanica.exe 94 PID 3936 wrote to memory of 3348 3936 mechanica.exe 94 PID 3936 wrote to memory of 3064 3936 mechanica.exe 96 PID 3936 wrote to memory of 3064 3936 mechanica.exe 96 PID 3936 wrote to memory of 128 3936 mechanica.exe 98 PID 3936 wrote to memory of 128 3936 mechanica.exe 98 PID 3936 wrote to memory of 2776 3936 mechanica.exe 100 PID 3936 wrote to memory of 2776 3936 mechanica.exe 100 PID 3936 wrote to memory of 1548 3936 mechanica.exe 102 PID 3936 wrote to memory of 1548 3936 mechanica.exe 102 PID 3936 wrote to memory of 3752 3936 mechanica.exe 104 PID 3936 wrote to memory of 3752 3936 mechanica.exe 104 PID 3752 wrote to memory of 4884 3752 cmd.exe 106 PID 3752 wrote to memory of 4884 3752 cmd.exe 106 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3868 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mechanica.exe"C:\Users\Admin\AppData\Local\Temp\mechanica.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\mechanica.exe"2⤵
- Views/modifies file attributes
PID:3868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mechanica.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:3064
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1548
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\mechanica.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:4884
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
948B
MD5b7f2d3cce47cfcbd08e14e8211baa044
SHA130a00787a9b9ad56842293657c3a1ccaa8c0edc9
SHA256b954f6623381085b581fdbcbcf5d757fb50fc286c654ec4f00ea5ca59e488694
SHA512c5c8f7075cda3f30555beb58a0a9eaa871b9a7a7c5e221dc89c3b0fafdb0980cfbd70a345636f2923c0dae1440fd3f8acc2900110c62c09cda64c9badbe03d01
-
Filesize
1KB
MD5a90b4707584041171553e72b34bfc940
SHA170eb4843983d6b57a7f255ace1e5cf3d068d7011
SHA256378d2414a7626d27d1734ed4f5c9df44569aa85ee20939274c7d638e53b9cb1d
SHA5122b02e49648472bb20675e5cc711a6a7481a3b185fc23408301dcf46f344e42241dab16134059be6ede27c9af744f5d0060758efcd0b6a6768c2ef486b3f4882e
-
Filesize
1KB
MD538ecc5b95c11e5a77558753102979c51
SHA1c0759b08ef377df9979d8835d8a7e464cd8eaf6b
SHA2562eb69abe0af5a2fb5bb313533cef641e25016876b874353f7d737c7ad672c79e
SHA5129bf4ce3bc097bdd0242bd105c936a9c9403d5ac83ec99e6a310591a7b8d26309485f3e0cdc4cba67c322f834c325a2b63a008adb078f3a3307094c4b68a48686
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82