Analysis
-
max time kernel
10s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
stealer v2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
stealer v2.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
stealer v2.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
stealer v2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
stealer v2.exe
Resource
win11-20240412-en
General
-
Target
stealer v2.exe
-
Size
678KB
-
MD5
942c8ba962017c3f597a54c44c9f57be
-
SHA1
bc06cee1fc7c218fe0732f6e13c95cb141fd3b2d
-
SHA256
fe9b415107f164c76a286b93f647b0501fb83e4dd7f839ab7fec9639c55084ae
-
SHA512
dee865eca7a6a206c1b197e711494118e6fb696ea3497971ea50222550202eb062d30d49f1814c57d80756fc4cb4c340119a65c895acc9f54f6c1c3820517de8
-
SSDEEP
12288:Riny90J6VGAQWUJFRjynsW+xUid6IeJO70Nv9cpzolz/:RoyJCNJFlysPd6RJOC4zolz/
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1231373922524598342/SZ4ChwOih600qv0UuiVxKSVU3wzAKLa2uHxdzmR7pdCC3h5QB7aPcVnGRyY3wZSRS0VF
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2660-53-0x0000000000A50000-0x0000000000A90000-memory.dmp family_umbral -
Executes dropped EXE 1 IoCs
Processes:
stealer.exepid process 1328 stealer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
stealer v2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" stealer v2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Drops file in Windows directory 2 IoCs
Processes:
stealer.exedescription ioc process File created C:\Windows\task.exe stealer.exe File opened for modification C:\Windows\task.exe stealer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1520 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1532 powershell.exe 2352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
stealer.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1328 stealer.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 2352 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
stealer v2.execmd.exestealer.exedescription pid process target process PID 2228 wrote to memory of 1680 2228 stealer v2.exe cmd.exe PID 2228 wrote to memory of 1680 2228 stealer v2.exe cmd.exe PID 2228 wrote to memory of 1680 2228 stealer v2.exe cmd.exe PID 1680 wrote to memory of 1328 1680 cmd.exe stealer.exe PID 1680 wrote to memory of 1328 1680 cmd.exe stealer.exe PID 1680 wrote to memory of 1328 1680 cmd.exe stealer.exe PID 1328 wrote to memory of 1532 1328 stealer.exe powershell.exe PID 1328 wrote to memory of 1532 1328 stealer.exe powershell.exe PID 1328 wrote to memory of 1532 1328 stealer.exe powershell.exe PID 1328 wrote to memory of 2352 1328 stealer.exe powershell.exe PID 1328 wrote to memory of 2352 1328 stealer.exe powershell.exe PID 1328 wrote to memory of 2352 1328 stealer.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\stealer v2.exe"C:\Users\Admin\AppData\Local\Temp\stealer v2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\cmd.execmd /c "stealer.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\stealer.exestealer.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\task.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'task.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8AD2.tmp.bat""4⤵PID:840
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:1520
-
C:\Windows\system32\taskeng.exetaskeng.exe {3DABA6DE-CCA5-409B-A169-248EF5BCFB21} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵PID:1540
-
C:\Windows\task.exeC:\Windows\task.exe2⤵PID:2660
-
C:\Windows\system32\schtasks.exeschtasks /run /TN Update3⤵PID:2888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\stealer.exeFilesize
671KB
MD5bdb421db1041dff30935a0c368f0316e
SHA115786e4eb3057abaeab7c2ebbb0e758d9d4c2216
SHA256ac14f5357b9e35f8e9fccd2727ae133f34acafbd442cdb6f438a6f7a70861ca2
SHA5120280a8eeb333437c2122b8e47414565bd8492fee285071e612fc09bb82591a56abd5bf4ed1b194f581656ad1f75727b5c51a6ae50f08d7ea7588c36daa9e6b59
-
C:\Users\Admin\AppData\Local\Temp\tmp8AD2.tmp.batFilesize
170B
MD58896799bd3ef5c639b9ef11c05c38066
SHA18915d6ff3dc86f4fe90430672fef753a5cd7e8bb
SHA25688628c0a389f61bb3f2f443a438abb7b87a054cac29502c5bf804047217632a9
SHA512a1c8879ec7b7cd5250a031697922f3f06045e1fabc4a031b5a4ad2b33cf3280899f78442943366a7c851cd20ccb103aaf01840a9c2fbcc8d13110506eb8485a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD56223fefd955979117628648d2f0d0a2b
SHA153264fecf8f70be00690458ec9873a3c005b5585
SHA2561aeb1b2e4151ce7febd0957877ce6c8f2c266291dd7d5da73797450afe64a42b
SHA51222a2e89cbd2e2ded4575163deca0d7caf42eaf9d2a630e5190ba733ef5d1f231bb24bb1ed8b4e802cbcc0f8acc2d5fc1d34c46ce4d65ce2bb9a71862b2755aff
-
memory/1328-6-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmpFilesize
9.9MB
-
memory/1328-5-0x0000000000DA0000-0x0000000000E4E000-memory.dmpFilesize
696KB
-
memory/1328-45-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmpFilesize
9.9MB
-
memory/1328-7-0x000000001B2C0000-0x000000001B340000-memory.dmpFilesize
512KB
-
memory/1532-16-0x000007FEEE000000-0x000007FEEE99D000-memory.dmpFilesize
9.6MB
-
memory/1532-15-0x0000000002720000-0x00000000027A0000-memory.dmpFilesize
512KB
-
memory/1532-17-0x0000000002720000-0x00000000027A0000-memory.dmpFilesize
512KB
-
memory/1532-18-0x0000000002720000-0x00000000027A0000-memory.dmpFilesize
512KB
-
memory/1532-19-0x0000000002720000-0x00000000027A0000-memory.dmpFilesize
512KB
-
memory/1532-20-0x000007FEEE000000-0x000007FEEE99D000-memory.dmpFilesize
9.6MB
-
memory/1532-14-0x000007FEEE000000-0x000007FEEE99D000-memory.dmpFilesize
9.6MB
-
memory/1532-13-0x0000000001F50000-0x0000000001F58000-memory.dmpFilesize
32KB
-
memory/1532-12-0x000000001B150000-0x000000001B432000-memory.dmpFilesize
2.9MB
-
memory/2352-26-0x000000001B240000-0x000000001B522000-memory.dmpFilesize
2.9MB
-
memory/2352-29-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/2352-30-0x000007FEED660000-0x000007FEEDFFD000-memory.dmpFilesize
9.6MB
-
memory/2352-31-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/2352-32-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/2352-33-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/2352-34-0x000007FEED660000-0x000007FEEDFFD000-memory.dmpFilesize
9.6MB
-
memory/2352-27-0x000007FEED660000-0x000007FEEDFFD000-memory.dmpFilesize
9.6MB
-
memory/2352-28-0x0000000001FA0000-0x0000000001FA8000-memory.dmpFilesize
32KB
-
memory/2660-49-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmpFilesize
9.9MB
-
memory/2660-50-0x0000000000CA0000-0x0000000000D4E000-memory.dmpFilesize
696KB
-
memory/2660-51-0x0000000000A90000-0x0000000000B10000-memory.dmpFilesize
512KB
-
memory/2660-53-0x0000000000A50000-0x0000000000A90000-memory.dmpFilesize
256KB
-
memory/2660-52-0x000000001A790000-0x000000001A7D4000-memory.dmpFilesize
272KB