Overview
overview
10Static
static
10C11Bootstr...up.exe
windows7-x64
10C11Bootstr...up.exe
windows10-2004-x64
10C11Bootstr...er.exe
windows7-x64
10C11Bootstr...er.exe
windows10-2004-x64
10C11Bootstr...on.bat
windows7-x64
10C11Bootstr...on.bat
windows10-2004-x64
10C11Bootstr...or.exe
windows7-x64
10C11Bootstr...or.exe
windows10-2004-x64
10C11Bootstr...ox.vbs
windows7-x64
1C11Bootstr...ox.vbs
windows10-2004-x64
1C11Bootstr...rt.bat
windows7-x64
1C11Bootstr...rt.bat
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 20:56
Behavioral task
behavioral1
Sample
C11Bootstrapper/Properties/C11Setup.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
C11Bootstrapper/Properties/C11Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
C11Bootstrapper/Properties/GuiLoader.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
C11Bootstrapper/Properties/GuiLoader.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
C11Bootstrapper/Properties/IndependenciesInstallation.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
C11Bootstrapper/Properties/IndependenciesInstallation.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
C11Bootstrapper/Properties/PageEditor.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
C11Bootstrapper/Properties/PageEditor.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
C11Bootstrapper/Properties/msgbox.vbs
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
C11Bootstrapper/Properties/msgbox.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
C11Bootstrapper/Start.bat
Resource
win7-20231129-en
General
-
Target
C11Bootstrapper/Properties/IndependenciesInstallation.bat
-
Size
489B
-
MD5
d8da01fb6f6288b044868f85228cbb10
-
SHA1
9d08c813ce59ab863c6ec3c68c336eed265c5e8a
-
SHA256
74416d022dde876ff622038a6359907da239bbd26ceb7024f5d39dd52f16c9de
-
SHA512
c92b83ba5513694e05cf908a747609dd6fd3c70944d04a9b8a62939f4372561e4feb567d158b0316853c50a0c241a1c8c075875746a1e538912ea91ff84c308e
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
chhphkahmfnasuyziqc
-
delay
1
-
install
false
-
install_folder
%Temp%
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2728-30-0x0000000001390000-0x00000000013D4000-memory.dmp family_umbral -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 4 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exepid process 2380 timeout.exe 2340 timeout.exe 1728 timeout.exe 2580 timeout.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
PageEditor.exeGuiLoader.exewmic.exedescription pid process Token: SeDebugPrivilege 2800 PageEditor.exe Token: SeDebugPrivilege 2728 GuiLoader.exe Token: SeIncreaseQuotaPrivilege 2800 PageEditor.exe Token: SeSecurityPrivilege 2800 PageEditor.exe Token: SeTakeOwnershipPrivilege 2800 PageEditor.exe Token: SeLoadDriverPrivilege 2800 PageEditor.exe Token: SeSystemProfilePrivilege 2800 PageEditor.exe Token: SeSystemtimePrivilege 2800 PageEditor.exe Token: SeProfSingleProcessPrivilege 2800 PageEditor.exe Token: SeIncBasePriorityPrivilege 2800 PageEditor.exe Token: SeCreatePagefilePrivilege 2800 PageEditor.exe Token: SeBackupPrivilege 2800 PageEditor.exe Token: SeRestorePrivilege 2800 PageEditor.exe Token: SeShutdownPrivilege 2800 PageEditor.exe Token: SeDebugPrivilege 2800 PageEditor.exe Token: SeSystemEnvironmentPrivilege 2800 PageEditor.exe Token: SeRemoteShutdownPrivilege 2800 PageEditor.exe Token: SeUndockPrivilege 2800 PageEditor.exe Token: SeManageVolumePrivilege 2800 PageEditor.exe Token: 33 2800 PageEditor.exe Token: 34 2800 PageEditor.exe Token: 35 2800 PageEditor.exe Token: SeIncreaseQuotaPrivilege 2800 PageEditor.exe Token: SeSecurityPrivilege 2800 PageEditor.exe Token: SeTakeOwnershipPrivilege 2800 PageEditor.exe Token: SeLoadDriverPrivilege 2800 PageEditor.exe Token: SeSystemProfilePrivilege 2800 PageEditor.exe Token: SeSystemtimePrivilege 2800 PageEditor.exe Token: SeProfSingleProcessPrivilege 2800 PageEditor.exe Token: SeIncBasePriorityPrivilege 2800 PageEditor.exe Token: SeCreatePagefilePrivilege 2800 PageEditor.exe Token: SeBackupPrivilege 2800 PageEditor.exe Token: SeRestorePrivilege 2800 PageEditor.exe Token: SeShutdownPrivilege 2800 PageEditor.exe Token: SeDebugPrivilege 2800 PageEditor.exe Token: SeSystemEnvironmentPrivilege 2800 PageEditor.exe Token: SeRemoteShutdownPrivilege 2800 PageEditor.exe Token: SeUndockPrivilege 2800 PageEditor.exe Token: SeManageVolumePrivilege 2800 PageEditor.exe Token: 33 2800 PageEditor.exe Token: 34 2800 PageEditor.exe Token: 35 2800 PageEditor.exe Token: SeIncreaseQuotaPrivilege 2936 wmic.exe Token: SeSecurityPrivilege 2936 wmic.exe Token: SeTakeOwnershipPrivilege 2936 wmic.exe Token: SeLoadDriverPrivilege 2936 wmic.exe Token: SeSystemProfilePrivilege 2936 wmic.exe Token: SeSystemtimePrivilege 2936 wmic.exe Token: SeProfSingleProcessPrivilege 2936 wmic.exe Token: SeIncBasePriorityPrivilege 2936 wmic.exe Token: SeCreatePagefilePrivilege 2936 wmic.exe Token: SeBackupPrivilege 2936 wmic.exe Token: SeRestorePrivilege 2936 wmic.exe Token: SeShutdownPrivilege 2936 wmic.exe Token: SeDebugPrivilege 2936 wmic.exe Token: SeSystemEnvironmentPrivilege 2936 wmic.exe Token: SeRemoteShutdownPrivilege 2936 wmic.exe Token: SeUndockPrivilege 2936 wmic.exe Token: SeManageVolumePrivilege 2936 wmic.exe Token: 33 2936 wmic.exe Token: 34 2936 wmic.exe Token: 35 2936 wmic.exe Token: SeIncreaseQuotaPrivilege 2936 wmic.exe Token: SeSecurityPrivilege 2936 wmic.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cmd.exeC11Setup.exeGuiLoader.exedescription pid process target process PID 2844 wrote to memory of 2380 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2380 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2380 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2340 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2340 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2340 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 1728 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 1728 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 1728 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2856 2844 cmd.exe WScript.exe PID 2844 wrote to memory of 2856 2844 cmd.exe WScript.exe PID 2844 wrote to memory of 2856 2844 cmd.exe WScript.exe PID 2844 wrote to memory of 2580 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2580 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2580 2844 cmd.exe timeout.exe PID 2844 wrote to memory of 2696 2844 cmd.exe C11Setup.exe PID 2844 wrote to memory of 2696 2844 cmd.exe C11Setup.exe PID 2844 wrote to memory of 2696 2844 cmd.exe C11Setup.exe PID 2844 wrote to memory of 2728 2844 cmd.exe GuiLoader.exe PID 2844 wrote to memory of 2728 2844 cmd.exe GuiLoader.exe PID 2844 wrote to memory of 2728 2844 cmd.exe GuiLoader.exe PID 2844 wrote to memory of 2800 2844 cmd.exe PageEditor.exe PID 2844 wrote to memory of 2800 2844 cmd.exe PageEditor.exe PID 2844 wrote to memory of 2800 2844 cmd.exe PageEditor.exe PID 2696 wrote to memory of 2668 2696 C11Setup.exe WerFault.exe PID 2696 wrote to memory of 2668 2696 C11Setup.exe WerFault.exe PID 2696 wrote to memory of 2668 2696 C11Setup.exe WerFault.exe PID 2728 wrote to memory of 2936 2728 GuiLoader.exe wmic.exe PID 2728 wrote to memory of 2936 2728 GuiLoader.exe wmic.exe PID 2728 wrote to memory of 2936 2728 GuiLoader.exe wmic.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\IndependenciesInstallation.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\timeout.exetimeout /t 52⤵
- Delays execution with timeout.exe
PID:2380 -
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2340 -
C:\Windows\system32\timeout.exetimeout /t 32⤵
- Delays execution with timeout.exe
PID:1728 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\msgbox.vbs"2⤵PID:2856
-
C:\Windows\system32\timeout.exetimeout /t 42⤵
- Delays execution with timeout.exe
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exeC11Setup.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2696 -s 5803⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exeGuiLoader.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\PageEditor.exePageEditor.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2696-31-0x0000000000D00000-0x0000000000D44000-memory.dmpFilesize
272KB
-
memory/2696-35-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmpFilesize
9.9MB
-
memory/2728-30-0x0000000001390000-0x00000000013D4000-memory.dmpFilesize
272KB
-
memory/2728-34-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmpFilesize
9.9MB
-
memory/2728-37-0x000000001A8F0000-0x000000001A970000-memory.dmpFilesize
512KB
-
memory/2728-38-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmpFilesize
9.9MB
-
memory/2800-29-0x0000000000200000-0x0000000000218000-memory.dmpFilesize
96KB
-
memory/2800-33-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmpFilesize
9.9MB
-
memory/2800-36-0x000000001A710000-0x000000001A790000-memory.dmpFilesize
512KB
-
memory/2800-39-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmpFilesize
9.9MB