Analysis
-
max time kernel
10s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
stealer v2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
stealer v2.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
stealer v2.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
stealer v2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
stealer v2.exe
Resource
win11-20240412-en
General
-
Target
stealer v2.exe
-
Size
678KB
-
MD5
942c8ba962017c3f597a54c44c9f57be
-
SHA1
bc06cee1fc7c218fe0732f6e13c95cb141fd3b2d
-
SHA256
fe9b415107f164c76a286b93f647b0501fb83e4dd7f839ab7fec9639c55084ae
-
SHA512
dee865eca7a6a206c1b197e711494118e6fb696ea3497971ea50222550202eb062d30d49f1814c57d80756fc4cb4c340119a65c895acc9f54f6c1c3820517de8
-
SSDEEP
12288:Riny90J6VGAQWUJFRjynsW+xUid6IeJO70Nv9cpzolz/:RoyJCNJFlysPd6RJOC4zolz/
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1231373922524598342/SZ4ChwOih600qv0UuiVxKSVU3wzAKLa2uHxdzmR7pdCC3h5QB7aPcVnGRyY3wZSRS0VF
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2660-53-0x0000000000A50000-0x0000000000A90000-memory.dmp family_umbral -
Executes dropped EXE 1 IoCs
pid Process 1328 stealer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" stealer v2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\task.exe stealer.exe File opened for modification C:\Windows\task.exe stealer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1520 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1532 powershell.exe 2352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1328 stealer.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 2352 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1680 2228 stealer v2.exe 30 PID 2228 wrote to memory of 1680 2228 stealer v2.exe 30 PID 2228 wrote to memory of 1680 2228 stealer v2.exe 30 PID 1680 wrote to memory of 1328 1680 cmd.exe 32 PID 1680 wrote to memory of 1328 1680 cmd.exe 32 PID 1680 wrote to memory of 1328 1680 cmd.exe 32 PID 1328 wrote to memory of 1532 1328 stealer.exe 33 PID 1328 wrote to memory of 1532 1328 stealer.exe 33 PID 1328 wrote to memory of 1532 1328 stealer.exe 33 PID 1328 wrote to memory of 2352 1328 stealer.exe 35 PID 1328 wrote to memory of 2352 1328 stealer.exe 35 PID 1328 wrote to memory of 2352 1328 stealer.exe 35 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\stealer v2.exe"C:\Users\Admin\AppData\Local\Temp\stealer v2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\cmd.execmd /c "stealer.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\stealer.exestealer.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\task.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'task.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8AD2.tmp.bat""4⤵PID:840
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:1520
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3DABA6DE-CCA5-409B-A169-248EF5BCFB21} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵PID:1540
-
C:\Windows\task.exeC:\Windows\task.exe2⤵PID:2660
-
C:\Windows\system32\schtasks.exeschtasks /run /TN Update3⤵PID:2888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
671KB
MD5bdb421db1041dff30935a0c368f0316e
SHA115786e4eb3057abaeab7c2ebbb0e758d9d4c2216
SHA256ac14f5357b9e35f8e9fccd2727ae133f34acafbd442cdb6f438a6f7a70861ca2
SHA5120280a8eeb333437c2122b8e47414565bd8492fee285071e612fc09bb82591a56abd5bf4ed1b194f581656ad1f75727b5c51a6ae50f08d7ea7588c36daa9e6b59
-
Filesize
170B
MD58896799bd3ef5c639b9ef11c05c38066
SHA18915d6ff3dc86f4fe90430672fef753a5cd7e8bb
SHA25688628c0a389f61bb3f2f443a438abb7b87a054cac29502c5bf804047217632a9
SHA512a1c8879ec7b7cd5250a031697922f3f06045e1fabc4a031b5a4ad2b33cf3280899f78442943366a7c851cd20ccb103aaf01840a9c2fbcc8d13110506eb8485a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56223fefd955979117628648d2f0d0a2b
SHA153264fecf8f70be00690458ec9873a3c005b5585
SHA2561aeb1b2e4151ce7febd0957877ce6c8f2c266291dd7d5da73797450afe64a42b
SHA51222a2e89cbd2e2ded4575163deca0d7caf42eaf9d2a630e5190ba733ef5d1f231bb24bb1ed8b4e802cbcc0f8acc2d5fc1d34c46ce4d65ce2bb9a71862b2755aff