Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
Resource
win7-20240221-en
General
-
Target
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
-
Size
2.3MB
-
MD5
2784277bd68152abf75c6c6d59fab7af
-
SHA1
e1d047c97e3bdfe273b215b42eccde32ca2ca63f
-
SHA256
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc
-
SHA512
e05b8251c9f6c59c7901d72c58f5b8c35dc376068368e67f81ee79da4287ddfc25c6ca5893d87944ed21c592bdd62f57d40a9f78c9af56762f33b010dd10b62c
-
SSDEEP
49152:T2Q8G4mSmM8sik/AJ+/GRfzlW+oCZBNKoiYNsVjGMFWm02qG6zSo2:T2VmT8B4JAGllW+DBNdtN811
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x00090000000233ed-7.dat family_umbral behavioral2/memory/4736-20-0x0000020E2C550000-0x0000020E2C590000-memory.dmp family_umbral -
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/4456-40-0x000001756FE40000-0x0000017570054000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1020 netsh.exe 216 netsh.exe 1488 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe -
Executes dropped EXE 3 IoCs
pid Process 4736 Umbral.exe 1912 svchost.exe 4456 ANDYzz-protected.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 45 0.tcp.eu.ngrok.io 54 discord.com 55 discord.com 273 0.tcp.eu.ngrok.io 424 0.tcp.eu.ngrok.io -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4756 wmic.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ANDYzz-protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion ANDYzz-protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ANDYzz-protected.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4736 Umbral.exe 4248 powershell.exe 4248 powershell.exe 4248 powershell.exe 3236 powershell.exe 3236 powershell.exe 3236 powershell.exe 4332 powershell.exe 4332 powershell.exe 4332 powershell.exe 2172 powershell.exe 2172 powershell.exe 2172 powershell.exe 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4736 Umbral.exe Token: SeIncreaseQuotaPrivilege 1132 wmic.exe Token: SeSecurityPrivilege 1132 wmic.exe Token: SeTakeOwnershipPrivilege 1132 wmic.exe Token: SeLoadDriverPrivilege 1132 wmic.exe Token: SeSystemProfilePrivilege 1132 wmic.exe Token: SeSystemtimePrivilege 1132 wmic.exe Token: SeProfSingleProcessPrivilege 1132 wmic.exe Token: SeIncBasePriorityPrivilege 1132 wmic.exe Token: SeCreatePagefilePrivilege 1132 wmic.exe Token: SeBackupPrivilege 1132 wmic.exe Token: SeRestorePrivilege 1132 wmic.exe Token: SeShutdownPrivilege 1132 wmic.exe Token: SeDebugPrivilege 1132 wmic.exe Token: SeSystemEnvironmentPrivilege 1132 wmic.exe Token: SeRemoteShutdownPrivilege 1132 wmic.exe Token: SeUndockPrivilege 1132 wmic.exe Token: SeManageVolumePrivilege 1132 wmic.exe Token: 33 1132 wmic.exe Token: 34 1132 wmic.exe Token: 35 1132 wmic.exe Token: 36 1132 wmic.exe Token: SeDebugPrivilege 4456 ANDYzz-protected.exe Token: SeIncreaseQuotaPrivilege 1132 wmic.exe Token: SeSecurityPrivilege 1132 wmic.exe Token: SeTakeOwnershipPrivilege 1132 wmic.exe Token: SeLoadDriverPrivilege 1132 wmic.exe Token: SeSystemProfilePrivilege 1132 wmic.exe Token: SeSystemtimePrivilege 1132 wmic.exe Token: SeProfSingleProcessPrivilege 1132 wmic.exe Token: SeIncBasePriorityPrivilege 1132 wmic.exe Token: SeCreatePagefilePrivilege 1132 wmic.exe Token: SeBackupPrivilege 1132 wmic.exe Token: SeRestorePrivilege 1132 wmic.exe Token: SeShutdownPrivilege 1132 wmic.exe Token: SeDebugPrivilege 1132 wmic.exe Token: SeSystemEnvironmentPrivilege 1132 wmic.exe Token: SeRemoteShutdownPrivilege 1132 wmic.exe Token: SeUndockPrivilege 1132 wmic.exe Token: SeManageVolumePrivilege 1132 wmic.exe Token: 33 1132 wmic.exe Token: 34 1132 wmic.exe Token: 35 1132 wmic.exe Token: 36 1132 wmic.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 3236 powershell.exe Token: SeDebugPrivilege 4332 powershell.exe Token: SeDebugPrivilege 2172 powershell.exe Token: SeIncreaseQuotaPrivilege 1068 wmic.exe Token: SeSecurityPrivilege 1068 wmic.exe Token: SeTakeOwnershipPrivilege 1068 wmic.exe Token: SeLoadDriverPrivilege 1068 wmic.exe Token: SeSystemProfilePrivilege 1068 wmic.exe Token: SeSystemtimePrivilege 1068 wmic.exe Token: SeProfSingleProcessPrivilege 1068 wmic.exe Token: SeIncBasePriorityPrivilege 1068 wmic.exe Token: SeCreatePagefilePrivilege 1068 wmic.exe Token: SeBackupPrivilege 1068 wmic.exe Token: SeRestorePrivilege 1068 wmic.exe Token: SeShutdownPrivilege 1068 wmic.exe Token: SeDebugPrivilege 1068 wmic.exe Token: SeSystemEnvironmentPrivilege 1068 wmic.exe Token: SeRemoteShutdownPrivilege 1068 wmic.exe Token: SeUndockPrivilege 1068 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 208 wrote to memory of 4736 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 89 PID 208 wrote to memory of 4736 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 89 PID 208 wrote to memory of 1912 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 90 PID 208 wrote to memory of 1912 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 90 PID 208 wrote to memory of 1912 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 90 PID 208 wrote to memory of 4456 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 91 PID 208 wrote to memory of 4456 208 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe 91 PID 4736 wrote to memory of 1132 4736 Umbral.exe 92 PID 4736 wrote to memory of 1132 4736 Umbral.exe 92 PID 4736 wrote to memory of 4248 4736 Umbral.exe 97 PID 4736 wrote to memory of 4248 4736 Umbral.exe 97 PID 1912 wrote to memory of 1020 1912 svchost.exe 99 PID 1912 wrote to memory of 1020 1912 svchost.exe 99 PID 1912 wrote to memory of 1020 1912 svchost.exe 99 PID 4736 wrote to memory of 3236 4736 Umbral.exe 102 PID 4736 wrote to memory of 3236 4736 Umbral.exe 102 PID 1912 wrote to memory of 1488 1912 svchost.exe 104 PID 1912 wrote to memory of 1488 1912 svchost.exe 104 PID 1912 wrote to memory of 1488 1912 svchost.exe 104 PID 1912 wrote to memory of 216 1912 svchost.exe 105 PID 1912 wrote to memory of 216 1912 svchost.exe 105 PID 1912 wrote to memory of 216 1912 svchost.exe 105 PID 4736 wrote to memory of 4332 4736 Umbral.exe 108 PID 4736 wrote to memory of 4332 4736 Umbral.exe 108 PID 4736 wrote to memory of 2172 4736 Umbral.exe 110 PID 4736 wrote to memory of 2172 4736 Umbral.exe 110 PID 4736 wrote to memory of 1068 4736 Umbral.exe 113 PID 4736 wrote to memory of 1068 4736 Umbral.exe 113 PID 4736 wrote to memory of 2484 4736 Umbral.exe 115 PID 4736 wrote to memory of 2484 4736 Umbral.exe 115 PID 4736 wrote to memory of 4692 4736 Umbral.exe 117 PID 4736 wrote to memory of 4692 4736 Umbral.exe 117 PID 4736 wrote to memory of 1624 4736 Umbral.exe 119 PID 4736 wrote to memory of 1624 4736 Umbral.exe 119 PID 4736 wrote to memory of 4756 4736 Umbral.exe 121 PID 4736 wrote to memory of 4756 4736 Umbral.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:2484
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:4756
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1020
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Modifies Windows Firewall
PID:1488
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:216
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
948B
MD5966914e2e771de7a4a57a95b6ecfa8a9
SHA17a32282fd51dd032967ed4d9a40cc57e265aeff2
SHA25698d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba
SHA512dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5
-
Filesize
1KB
MD5d3235ed022a42ec4338123ab87144afa
SHA15058608bc0deb720a585a2304a8f7cf63a50a315
SHA25610663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27
SHA512236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf
-
Filesize
1KB
MD5107102102e02e48f37f5318c7e113c43
SHA17fb10fc65c85fb4c050309f0872bc9389dcccc0d
SHA2563c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7
SHA512b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
2.5MB
MD533eb68c8c4fc521d64ed82219cdb19f2
SHA12d114152924ea141df11082d6f337bf7e9a81035
SHA25624251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0
SHA5120b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a
-
Filesize
231KB
MD5774fa31e76af56bbad395e1e3ac68721
SHA1fe65c14179b2cf0cbd44758578cf878d7dcef879
SHA256944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4
SHA512529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
93KB
MD53071f4f7b11a6bf6c623e83eed6d2418
SHA137fd78d1296659109f2c94c9c750b5a98d158f11
SHA256508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e
SHA512e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8