Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 08:44
Static task
static1
Behavioral task
behavioral1
Sample
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
Resource
win7-20231129-en
General
-
Target
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
-
Size
2.3MB
-
MD5
2784277bd68152abf75c6c6d59fab7af
-
SHA1
e1d047c97e3bdfe273b215b42eccde32ca2ca63f
-
SHA256
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc
-
SHA512
e05b8251c9f6c59c7901d72c58f5b8c35dc376068368e67f81ee79da4287ddfc25c6ca5893d87944ed21c592bdd62f57d40a9f78c9af56762f33b010dd10b62c
-
SSDEEP
49152:T2Q8G4mSmM8sik/AJ+/GRfzlW+oCZBNKoiYNsVjGMFWm02qG6zSo2:T2VmT8B4JAGllW+DBNdtN811
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x000d00000002337b-7.dat family_umbral behavioral2/memory/4884-20-0x00000236A6090000-0x00000236A60D0000-memory.dmp family_umbral -
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/3760-42-0x0000013C61A10000-0x0000013C61C24000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3500 netsh.exe 3156 netsh.exe 2300 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe -
Executes dropped EXE 3 IoCs
pid Process 4884 Umbral.exe 5104 svchost.exe 3760 ANDYzz-protected.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 59 discord.com 60 discord.com 108 0.tcp.eu.ngrok.io 154 0.tcp.eu.ngrok.io 49 0.tcp.eu.ngrok.io 53 0.tcp.eu.ngrok.io -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3276 wmic.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ANDYzz-protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ANDYzz-protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion ANDYzz-protected.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4884 Umbral.exe 2392 powershell.exe 2392 powershell.exe 2392 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 2016 powershell.exe 2016 powershell.exe 2016 powershell.exe 1784 powershell.exe 1784 powershell.exe 1784 powershell.exe 2364 powershell.exe 2364 powershell.exe 2364 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5104 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4884 Umbral.exe Token: SeDebugPrivilege 3760 ANDYzz-protected.exe Token: SeIncreaseQuotaPrivilege 3032 wmic.exe Token: SeSecurityPrivilege 3032 wmic.exe Token: SeTakeOwnershipPrivilege 3032 wmic.exe Token: SeLoadDriverPrivilege 3032 wmic.exe Token: SeSystemProfilePrivilege 3032 wmic.exe Token: SeSystemtimePrivilege 3032 wmic.exe Token: SeProfSingleProcessPrivilege 3032 wmic.exe Token: SeIncBasePriorityPrivilege 3032 wmic.exe Token: SeCreatePagefilePrivilege 3032 wmic.exe Token: SeBackupPrivilege 3032 wmic.exe Token: SeRestorePrivilege 3032 wmic.exe Token: SeShutdownPrivilege 3032 wmic.exe Token: SeDebugPrivilege 3032 wmic.exe Token: SeSystemEnvironmentPrivilege 3032 wmic.exe Token: SeRemoteShutdownPrivilege 3032 wmic.exe Token: SeUndockPrivilege 3032 wmic.exe Token: SeManageVolumePrivilege 3032 wmic.exe Token: 33 3032 wmic.exe Token: 34 3032 wmic.exe Token: 35 3032 wmic.exe Token: 36 3032 wmic.exe Token: SeIncreaseQuotaPrivilege 3032 wmic.exe Token: SeSecurityPrivilege 3032 wmic.exe Token: SeTakeOwnershipPrivilege 3032 wmic.exe Token: SeLoadDriverPrivilege 3032 wmic.exe Token: SeSystemProfilePrivilege 3032 wmic.exe Token: SeSystemtimePrivilege 3032 wmic.exe Token: SeProfSingleProcessPrivilege 3032 wmic.exe Token: SeIncBasePriorityPrivilege 3032 wmic.exe Token: SeCreatePagefilePrivilege 3032 wmic.exe Token: SeBackupPrivilege 3032 wmic.exe Token: SeRestorePrivilege 3032 wmic.exe Token: SeShutdownPrivilege 3032 wmic.exe Token: SeDebugPrivilege 3032 wmic.exe Token: SeSystemEnvironmentPrivilege 3032 wmic.exe Token: SeRemoteShutdownPrivilege 3032 wmic.exe Token: SeUndockPrivilege 3032 wmic.exe Token: SeManageVolumePrivilege 3032 wmic.exe Token: 33 3032 wmic.exe Token: 34 3032 wmic.exe Token: 35 3032 wmic.exe Token: 36 3032 wmic.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 5104 svchost.exe Token: 33 5104 svchost.exe Token: SeIncBasePriorityPrivilege 5104 svchost.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeIncreaseQuotaPrivilege 3928 wmic.exe Token: SeSecurityPrivilege 3928 wmic.exe Token: SeTakeOwnershipPrivilege 3928 wmic.exe Token: SeLoadDriverPrivilege 3928 wmic.exe Token: SeSystemProfilePrivilege 3928 wmic.exe Token: SeSystemtimePrivilege 3928 wmic.exe Token: SeProfSingleProcessPrivilege 3928 wmic.exe Token: SeIncBasePriorityPrivilege 3928 wmic.exe Token: SeCreatePagefilePrivilege 3928 wmic.exe Token: SeBackupPrivilege 3928 wmic.exe Token: SeRestorePrivilege 3928 wmic.exe Token: SeShutdownPrivilege 3928 wmic.exe Token: SeDebugPrivilege 3928 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4884 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 91 PID 2516 wrote to memory of 4884 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 91 PID 2516 wrote to memory of 5104 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 92 PID 2516 wrote to memory of 5104 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 92 PID 2516 wrote to memory of 5104 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 92 PID 2516 wrote to memory of 3760 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 93 PID 2516 wrote to memory of 3760 2516 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 93 PID 4884 wrote to memory of 3032 4884 Umbral.exe 95 PID 4884 wrote to memory of 3032 4884 Umbral.exe 95 PID 5104 wrote to memory of 3500 5104 svchost.exe 97 PID 5104 wrote to memory of 3500 5104 svchost.exe 97 PID 5104 wrote to memory of 3500 5104 svchost.exe 97 PID 5104 wrote to memory of 3156 5104 svchost.exe 100 PID 5104 wrote to memory of 3156 5104 svchost.exe 100 PID 5104 wrote to memory of 3156 5104 svchost.exe 100 PID 5104 wrote to memory of 2300 5104 svchost.exe 101 PID 5104 wrote to memory of 2300 5104 svchost.exe 101 PID 5104 wrote to memory of 2300 5104 svchost.exe 101 PID 4884 wrote to memory of 2392 4884 Umbral.exe 104 PID 4884 wrote to memory of 2392 4884 Umbral.exe 104 PID 4884 wrote to memory of 5100 4884 Umbral.exe 107 PID 4884 wrote to memory of 5100 4884 Umbral.exe 107 PID 4884 wrote to memory of 2016 4884 Umbral.exe 112 PID 4884 wrote to memory of 2016 4884 Umbral.exe 112 PID 4884 wrote to memory of 1784 4884 Umbral.exe 115 PID 4884 wrote to memory of 1784 4884 Umbral.exe 115 PID 4884 wrote to memory of 3928 4884 Umbral.exe 118 PID 4884 wrote to memory of 3928 4884 Umbral.exe 118 PID 4884 wrote to memory of 4772 4884 Umbral.exe 120 PID 4884 wrote to memory of 4772 4884 Umbral.exe 120 PID 4884 wrote to memory of 964 4884 Umbral.exe 122 PID 4884 wrote to memory of 964 4884 Umbral.exe 122 PID 4884 wrote to memory of 2364 4884 Umbral.exe 124 PID 4884 wrote to memory of 2364 4884 Umbral.exe 124 PID 4884 wrote to memory of 3276 4884 Umbral.exe 126 PID 4884 wrote to memory of 3276 4884 Umbral.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:4772
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:3276
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3500
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Modifies Windows Firewall
PID:3156
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2300
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
948B
MD51aefe566d0c19c9e3ddaf9ea005f71c0
SHA18d8cfb0d2192706100eb241f38a32b31f03329f1
SHA256dc85b671f8ebac6cfa68897b1826019925c95a5ec36676fe18ba0085f437905a
SHA512f22782b33f7990a0783154fbe6d49e03f16c873a3b4c91f1fc5ed76d0e7b88f0df876ccdf007828ba4d9a5f97cb2362f922cbacad03de5804bc8abeb36cb2d09
-
Filesize
1KB
MD5d3235ed022a42ec4338123ab87144afa
SHA15058608bc0deb720a585a2304a8f7cf63a50a315
SHA25610663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27
SHA512236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf
-
Filesize
1KB
MD57511c81925750deb7ad1b9b80eea8a8d
SHA16ea759b3cbd243ae11435c6d6c5ced185eb01f49
SHA2565b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa
SHA5125f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
2.5MB
MD533eb68c8c4fc521d64ed82219cdb19f2
SHA12d114152924ea141df11082d6f337bf7e9a81035
SHA25624251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0
SHA5120b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a
-
Filesize
231KB
MD5774fa31e76af56bbad395e1e3ac68721
SHA1fe65c14179b2cf0cbd44758578cf878d7dcef879
SHA256944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4
SHA512529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
93KB
MD53071f4f7b11a6bf6c623e83eed6d2418
SHA137fd78d1296659109f2c94c9c750b5a98d158f11
SHA256508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e
SHA512e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8