Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 20:42

General

  • Target

    RocketTitles.exe

  • Size

    464KB

  • MD5

    d01895f1bcb893f652d14a63403d8e99

  • SHA1

    9dd910e9c32719ba86b3b1d9da7d9037c5cfd6d8

  • SHA256

    8269ab6c110238c609466167f327de678c926cb5df8e40355918cd256f2aa59a

  • SHA512

    6cb47c51a823d7683330fa4cbc38315fef10cbd6199b1841a72afaa983093f00e102029bad7bd41d2b4c06d20615dd873f8d7abe62eeb92b58d7f725055dae3c

  • SSDEEP

    12288:27nT0Qq3DUyTfvqCT/4k2QjqGpNBOewDld:2bTUDR3qCr4khqGrUtDld

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1236047504458518648/JQRxvzCGg9gVDBGAsCh4Y7lt6-VpyZJcpy_w2pc8Qwt0sZVsg3Znypp4Lv0kPFzHxpM9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • AgentTesla payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe
    "C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\mac_1.bat
      "C:\Windows\mac_1.bat"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
    • C:\Windows\mac_1.bat
      "C:\Windows\mac_1.bat"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:520
    • C:\Windows\mac_1.bat
      "C:\Windows\mac_1.bat"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
          PID:4908
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      1⤵
        PID:4996
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4256

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mac_1.bat.log

          Filesize

          1KB

          MD5

          8094b248fe3231e48995c2be32aeb08c

          SHA1

          2fe06e000ebec919bf982d033c5d1219c1f916b6

          SHA256

          136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

          SHA512

          bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

        • C:\Windows\mac_1.bat

          Filesize

          229KB

          MD5

          dd294f4a30b78637d2de6ae794442508

          SHA1

          2f28200fb482bb7f280ecde35070b8bf181900ef

          SHA256

          a89f3d297cbac8b605cd554dd0ea7891c7fcff9e63c7c22810d1c8121fd128b1

          SHA512

          cc4343ab3d9dc6f6eb8312a28df24442280144d3c54fe3fca65412b6285ae98c264a67a70a86b1fd73418bee535ea5adbe968e7b48a40ad833beaabf459d7bf5

        • memory/4300-21-0x000001868C670000-0x000001868C6B0000-memory.dmp

          Filesize

          256KB

        • memory/4900-8-0x0000000074A40000-0x00000000751F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-10-0x00000000092F0000-0x0000000009312000-memory.dmp

          Filesize

          136KB

        • memory/4900-5-0x0000000074A40000-0x00000000751F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-6-0x0000000005130000-0x000000000513A000-memory.dmp

          Filesize

          40KB

        • memory/4900-7-0x0000000005B40000-0x0000000005D54000-memory.dmp

          Filesize

          2.1MB

        • memory/4900-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

          Filesize

          4KB

        • memory/4900-9-0x0000000009340000-0x00000000093F2000-memory.dmp

          Filesize

          712KB

        • memory/4900-4-0x0000000005000000-0x0000000005012000-memory.dmp

          Filesize

          72KB

        • memory/4900-11-0x0000000009400000-0x0000000009754000-memory.dmp

          Filesize

          3.3MB

        • memory/4900-13-0x00000000097C0000-0x00000000097FC000-memory.dmp

          Filesize

          240KB

        • memory/4900-14-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

          Filesize

          4KB

        • memory/4900-3-0x0000000005080000-0x0000000005112000-memory.dmp

          Filesize

          584KB

        • memory/4900-2-0x0000000005590000-0x0000000005B34000-memory.dmp

          Filesize

          5.6MB

        • memory/4900-23-0x0000000074A40000-0x00000000751F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-24-0x0000000074A40000-0x00000000751F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-1-0x00000000005E0000-0x000000000065A000-memory.dmp

          Filesize

          488KB