Analysis

  • max time kernel
    7s
  • max time network
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 13:52

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-22T13:53:58Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_4-dirty.qcow2\"}"

General

  • Target

    stealer v2.exe

  • Size

    678KB

  • MD5

    942c8ba962017c3f597a54c44c9f57be

  • SHA1

    bc06cee1fc7c218fe0732f6e13c95cb141fd3b2d

  • SHA256

    fe9b415107f164c76a286b93f647b0501fb83e4dd7f839ab7fec9639c55084ae

  • SHA512

    dee865eca7a6a206c1b197e711494118e6fb696ea3497971ea50222550202eb062d30d49f1814c57d80756fc4cb4c340119a65c895acc9f54f6c1c3820517de8

  • SSDEEP

    12288:Riny90J6VGAQWUJFRjynsW+xUid6IeJO70Nv9cpzolz/:RoyJCNJFlysPd6RJOC4zolz/

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1231373922524598342/SZ4ChwOih600qv0UuiVxKSVU3wzAKLa2uHxdzmR7pdCC3h5QB7aPcVnGRyY3wZSRS0VF

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\stealer v2.exe
    "C:\Users\Admin\AppData\Local\Temp\stealer v2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c "stealer.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\stealer.exe
        stealer.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\task.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'task.exe'
          4⤵
            PID:3432
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6793.tmp.bat""
            4⤵
              PID:4996
              • C:\Windows\system32\timeout.exe
                timeout 3
                5⤵
                • Delays execution with timeout.exe
                PID:5044
      • C:\Windows\task.exe
        C:\Windows\task.exe
        1⤵
          PID:3988
          • C:\Windows\system32\schtasks.exe
            schtasks /run /TN Update
            2⤵
              PID:4856

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            62623d22bd9e037191765d5083ce16a3

            SHA1

            4a07da6872672f715a4780513d95ed8ddeefd259

            SHA256

            95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

            SHA512

            9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\stealer.exe

            Filesize

            671KB

            MD5

            bdb421db1041dff30935a0c368f0316e

            SHA1

            15786e4eb3057abaeab7c2ebbb0e758d9d4c2216

            SHA256

            ac14f5357b9e35f8e9fccd2727ae133f34acafbd442cdb6f438a6f7a70861ca2

            SHA512

            0280a8eeb333437c2122b8e47414565bd8492fee285071e612fc09bb82591a56abd5bf4ed1b194f581656ad1f75727b5c51a6ae50f08d7ea7588c36daa9e6b59

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n5yd3hmg.ocq.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmp6793.tmp.bat

            Filesize

            170B

            MD5

            2052f8eb3d55d5a3db3e3ff93149506e

            SHA1

            7b5b80e4b565e7dfb2b63fe9769d1895030834a0

            SHA256

            fda5b368fe922464fae79b3a1bb0b7183540d3a204b5ac44a6c4061dd739f222

            SHA512

            629bf082709a75d05357ab2c9b204c915bb2dd38e1ecaf76565c2a4b96427448d8133b9f6210f24c2b271c28216ec52278cf951ce9db54080f6a0525370a8a38

          • memory/2320-41-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/2320-48-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/2320-5-0x0000000000140000-0x00000000001EE000-memory.dmp

            Filesize

            696KB

          • memory/2320-6-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/2320-7-0x000000001AE20000-0x000000001AE30000-memory.dmp

            Filesize

            64KB

          • memory/3432-36-0x000001CCF25A0000-0x000001CCF25B0000-memory.dmp

            Filesize

            64KB

          • memory/3432-38-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/3432-35-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/3988-49-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/3988-51-0x000000001B2D0000-0x000000001B310000-memory.dmp

            Filesize

            256KB

          • memory/3988-50-0x000000001B490000-0x000000001B4A0000-memory.dmp

            Filesize

            64KB

          • memory/3988-52-0x000000001B310000-0x000000001B354000-memory.dmp

            Filesize

            272KB

          • memory/4908-13-0x0000026D5C560000-0x0000026D5C582000-memory.dmp

            Filesize

            136KB

          • memory/4908-23-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB

          • memory/4908-20-0x0000026D5C5A0000-0x0000026D5C5B0000-memory.dmp

            Filesize

            64KB

          • memory/4908-19-0x0000026D5C5A0000-0x0000026D5C5B0000-memory.dmp

            Filesize

            64KB

          • memory/4908-18-0x00007FFA40940000-0x00007FFA41401000-memory.dmp

            Filesize

            10.8MB