Analysis
-
max time kernel
4s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 12:09
Behavioral task
behavioral1
Sample
Malinovka Install.exe
Resource
win7-20240221-en
General
-
Target
Malinovka Install.exe
-
Size
319KB
-
MD5
f69924b642ac4b9ef1dfacdfd43759a9
-
SHA1
95da50564c7cbc3749148419c68a08b0f2869ee1
-
SHA256
d9b248ce98a243a37d33096fc7b1cad784ee77f5920b0bd6618a6690ca426f18
-
SHA512
2334511265c507d16b3a323c721a392659feb405a5d9fea588146c4ef320261166312c2fcf8f494c4aa342e0b5a9d5da20576ce2d6ae1e3215ee47dcc19f5e07
-
SSDEEP
6144:48loZMCrIkd8g+EtXHkv/iD4DDUgoOJBiLHaIJtM34b8e1mmiW2brXv5P:7oZRL+EP8DDUgoOJBiLHaIJtMQIL/5P
Malware Config
Extracted
xworm
phentermine-partial.gl.at.ply.gg:36969
-
Install_directory
%AppData%
-
install_file
Client.exe
-
telegram
https://api.telegram.org/bot7080511499:AAGFFOA3S2vvwmEy85SIMhKHrMsAdBoLR2Y
Signatures
-
Detect Umbral payload 3 IoCs
resource yara_rule behavioral2/files/0x00080000000233f9-4.dat family_umbral behavioral2/memory/3520-20-0x000001F4EF240000-0x000001F4EF280000-memory.dmp family_umbral behavioral2/memory/1868-23-0x0000000000400000-0x0000000000457000-memory.dmp family_umbral -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral2/files/0x00080000000233fc-21.dat family_xworm behavioral2/memory/1868-23-0x0000000000400000-0x0000000000457000-memory.dmp family_xworm behavioral2/memory/848-24-0x0000000000E00000-0x0000000000E1A000-memory.dmp family_xworm -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral3.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Malinovka Install.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation XClient.exe -
Executes dropped EXE 2 IoCs
pid Process 3520 Umbral3.exe 848 XClient.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 discord.com 20 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2736 wmic.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3648 powershell.exe 3648 powershell.exe 4704 powershell.exe 4704 powershell.exe 4988 powershell.exe 4988 powershell.exe 1656 powershell.exe 1656 powershell.exe 5036 powershell.exe 5036 powershell.exe 4504 powershell.exe 4504 powershell.exe 2532 powershell.exe 2532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 848 XClient.exe Token: SeDebugPrivilege 3520 Umbral3.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeDebugPrivilege 4704 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 1656 powershell.exe Token: SeIncreaseQuotaPrivilege 1776 wmic.exe Token: SeSecurityPrivilege 1776 wmic.exe Token: SeTakeOwnershipPrivilege 1776 wmic.exe Token: SeLoadDriverPrivilege 1776 wmic.exe Token: SeSystemProfilePrivilege 1776 wmic.exe Token: SeSystemtimePrivilege 1776 wmic.exe Token: SeProfSingleProcessPrivilege 1776 wmic.exe Token: SeIncBasePriorityPrivilege 1776 wmic.exe Token: SeCreatePagefilePrivilege 1776 wmic.exe Token: SeBackupPrivilege 1776 wmic.exe Token: SeRestorePrivilege 1776 wmic.exe Token: SeShutdownPrivilege 1776 wmic.exe Token: SeDebugPrivilege 1776 wmic.exe Token: SeSystemEnvironmentPrivilege 1776 wmic.exe Token: SeRemoteShutdownPrivilege 1776 wmic.exe Token: SeUndockPrivilege 1776 wmic.exe Token: SeManageVolumePrivilege 1776 wmic.exe Token: 33 1776 wmic.exe Token: 34 1776 wmic.exe Token: 35 1776 wmic.exe Token: 36 1776 wmic.exe Token: SeIncreaseQuotaPrivilege 1776 wmic.exe Token: SeSecurityPrivilege 1776 wmic.exe Token: SeTakeOwnershipPrivilege 1776 wmic.exe Token: SeLoadDriverPrivilege 1776 wmic.exe Token: SeSystemProfilePrivilege 1776 wmic.exe Token: SeSystemtimePrivilege 1776 wmic.exe Token: SeProfSingleProcessPrivilege 1776 wmic.exe Token: SeIncBasePriorityPrivilege 1776 wmic.exe Token: SeCreatePagefilePrivilege 1776 wmic.exe Token: SeBackupPrivilege 1776 wmic.exe Token: SeRestorePrivilege 1776 wmic.exe Token: SeShutdownPrivilege 1776 wmic.exe Token: SeDebugPrivilege 1776 wmic.exe Token: SeSystemEnvironmentPrivilege 1776 wmic.exe Token: SeRemoteShutdownPrivilege 1776 wmic.exe Token: SeUndockPrivilege 1776 wmic.exe Token: SeManageVolumePrivilege 1776 wmic.exe Token: 33 1776 wmic.exe Token: 34 1776 wmic.exe Token: 35 1776 wmic.exe Token: 36 1776 wmic.exe Token: SeIncreaseQuotaPrivilege 4900 wmic.exe Token: SeSecurityPrivilege 4900 wmic.exe Token: SeTakeOwnershipPrivilege 4900 wmic.exe Token: SeLoadDriverPrivilege 4900 wmic.exe Token: SeSystemProfilePrivilege 4900 wmic.exe Token: SeSystemtimePrivilege 4900 wmic.exe Token: SeProfSingleProcessPrivilege 4900 wmic.exe Token: SeIncBasePriorityPrivilege 4900 wmic.exe Token: SeCreatePagefilePrivilege 4900 wmic.exe Token: SeBackupPrivilege 4900 wmic.exe Token: SeRestorePrivilege 4900 wmic.exe Token: SeShutdownPrivilege 4900 wmic.exe Token: SeDebugPrivilege 4900 wmic.exe Token: SeSystemEnvironmentPrivilege 4900 wmic.exe Token: SeRemoteShutdownPrivilege 4900 wmic.exe Token: SeUndockPrivilege 4900 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1868 wrote to memory of 3520 1868 Malinovka Install.exe 82 PID 1868 wrote to memory of 3520 1868 Malinovka Install.exe 82 PID 1868 wrote to memory of 848 1868 Malinovka Install.exe 83 PID 1868 wrote to memory of 848 1868 Malinovka Install.exe 83 PID 3520 wrote to memory of 4252 3520 Umbral3.exe 85 PID 3520 wrote to memory of 4252 3520 Umbral3.exe 85 PID 3520 wrote to memory of 3648 3520 Umbral3.exe 87 PID 3520 wrote to memory of 3648 3520 Umbral3.exe 87 PID 3520 wrote to memory of 4704 3520 Umbral3.exe 89 PID 3520 wrote to memory of 4704 3520 Umbral3.exe 89 PID 3520 wrote to memory of 4988 3520 Umbral3.exe 91 PID 3520 wrote to memory of 4988 3520 Umbral3.exe 91 PID 3520 wrote to memory of 1656 3520 Umbral3.exe 93 PID 3520 wrote to memory of 1656 3520 Umbral3.exe 93 PID 3520 wrote to memory of 1776 3520 Umbral3.exe 95 PID 3520 wrote to memory of 1776 3520 Umbral3.exe 95 PID 3520 wrote to memory of 4900 3520 Umbral3.exe 98 PID 3520 wrote to memory of 4900 3520 Umbral3.exe 98 PID 3520 wrote to memory of 4088 3520 Umbral3.exe 100 PID 3520 wrote to memory of 4088 3520 Umbral3.exe 100 PID 3520 wrote to memory of 5036 3520 Umbral3.exe 102 PID 3520 wrote to memory of 5036 3520 Umbral3.exe 102 PID 3520 wrote to memory of 2736 3520 Umbral3.exe 104 PID 3520 wrote to memory of 2736 3520 Umbral3.exe 104 PID 848 wrote to memory of 4504 848 XClient.exe 106 PID 848 wrote to memory of 4504 848 XClient.exe 106 PID 848 wrote to memory of 2532 848 XClient.exe 108 PID 848 wrote to memory of 2532 848 XClient.exe 108 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4252 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malinovka Install.exe"C:\Users\Admin\AppData\Local\Temp\Malinovka Install.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\Umbral3.exe"C:\Users\Admin\AppData\Local\Temp\Umbral3.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral3.exe"3⤵
- Views/modifies file attributes
PID:4252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral3.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2736
-
-
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bb059cd5ec81445db881376f4c2d7eeb
SHA1d36313ed7b12132106252009b2658a1c70fb1e87
SHA256987d374beac33bedb33df17b602f2fdf5cdf81fa14f11dbbe606506efb8a74ad
SHA512ce6f532e13d8353b3ad64be2d55df9600bb700dd8a4e1f8f16b1d52c416f97c7a71927a2165d74771ce7bb81dcdc33a7cf39d7f6b4dee5b9b36af22668262409
-
Filesize
64B
MD5c6aae9fb57ebd2ae201e8d174d820246
SHA158140d968de47bcf9c78938988a99369bbdb1f51
SHA256bbc39a8da61fd8ec0d64e708e1ab4986f7fdf580581e464629bf040c595f7c08
SHA5125959f7dab47bc4bad03635f497ca48f2e0740375528afddfc50964e54983e56df5970b25b8d8b28f1aa73cd6233fac83c634a311e759c58a365570e4862c3e3c
-
Filesize
944B
MD596ff1ee586a153b4e7ce8661cabc0442
SHA1140d4ff1840cb40601489f3826954386af612136
SHA2560673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
SHA5123404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD51a58f982c18490e622e00d4eb75ace5a
SHA160c30527b74659ecf09089a5a7c02a1df9a71b65
SHA2564b7f800c0dea209162cc86627983993127eb20e3f8616646c41cb3ce15d9b39d
SHA512ddab516a967783c5951717853aa5b3ef6dd5b442db50092888b2e7f3179fc68120fcde69a08d6ab280740eaadb6eadfc758c3118b52706f869e48ac1aebda480
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
229KB
MD57a902c87a60986f18a6b097712299256
SHA12c01906a39faa9d27a41e0d3cd84e92410b9c483
SHA256e4e4f9045dc3683a2a69b9c7625f2ff46ed241ff64b47660a039dbc9d34cb0d5
SHA512c8b75b3f0a77d1f84167af3c431e186802ccd5271fc4a361142e0209541de37f5d584d487bf5ea4b4d921e6e3846267fdea9f65cbd71001331bfea08de5425b6
-
Filesize
80KB
MD53fc932775533f1bcea180de679a902dd
SHA13f393d02af4653e34bf5526ec5b6f8d6e4df65e8
SHA25609a15daeebc228706f36a7659284ef673ea72e7a71700a2f73f4f1409486dd6a
SHA512f59d35a6fe5517a5b9a1ec9a07899eef9f48745710196f1824cc79823994d6fba7975da457ee06ec6215f56860680dc0c07412268c2b1c725c4c66611a75a764
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82