Analysis

  • max time kernel
    119s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 20:44

General

  • Target

    RocketTitles.exe

  • Size

    464KB

  • MD5

    f11a1e49b2e53e4ad13c68c049d69c1f

  • SHA1

    26fca9e7cdd2deb0a085597eaacc96d5f96e88a8

  • SHA256

    81ba1eb0965ae6b7755e79a5d8ad19cb9ece2ba87e5e25cd718fe722c1c277e1

  • SHA512

    932b02adc97750357b95d59dfe41e8d414690c0a8437e2c1bcb5ff6bde913639a3145371837ba7a570508e06f1282a12925fe0b10ebf04ee550fb5590ba3977c

  • SSDEEP

    12288:MMms0Qz3DUyTfvqCT/4k2QjqGpNBOewDlJ:MfsjDR3qCr4khqGrUtDlJ

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1236047504458518648/JQRxvzCGg9gVDBGAsCh4Y7lt6-VpyZJcpy_w2pc8Qwt0sZVsg3Znypp4Lv0kPFzHxpM9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • AgentTesla payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe
    "C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\mac_1.bat
      "C:\Windows\mac_1.bat"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\mac_1.bat'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:376
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:1540
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:2580
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1584
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:348
      • C:\Windows\system32\notepad.exe
        "C:\Windows\system32\notepad.exe"
        1⤵
          PID:2304

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          77d622bb1a5b250869a3238b9bc1402b

          SHA1

          d47f4003c2554b9dfc4c16f22460b331886b191b

          SHA256

          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

          SHA512

          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          5824a6037c081fda5d46de274b6e2799

          SHA1

          526367a09300cbde430e8fb44e41cbe7a0937aac

          SHA256

          4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f

          SHA512

          a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          548dd08570d121a65e82abb7171cae1c

          SHA1

          1a1b5084b3a78f3acd0d811cc79dbcac121217ab

          SHA256

          cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

          SHA512

          37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          ec79fae4e7c09310ebf4f2d85a33a638

          SHA1

          f2bdd995b12e65e7ed437d228f22223b59e76efb

          SHA256

          e9c4723a5fe34e081c3d2f548a1d472394cc7aa58056fcf44ca542061381243a

          SHA512

          af9dda12f6bb388d826fe03a4a8beed9bda23a978aa55a2af6a43271660ee896a7ee3bcf2c4d2f1e6180902791d8c23560f1c2ec097a501d8c6f4f6c49075625

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3kwitwa.bhn.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Windows\mac_1.bat

          Filesize

          229KB

          MD5

          dd294f4a30b78637d2de6ae794442508

          SHA1

          2f28200fb482bb7f280ecde35070b8bf181900ef

          SHA256

          a89f3d297cbac8b605cd554dd0ea7891c7fcff9e63c7c22810d1c8121fd128b1

          SHA512

          cc4343ab3d9dc6f6eb8312a28df24442280144d3c54fe3fca65412b6285ae98c264a67a70a86b1fd73418bee535ea5adbe968e7b48a40ad833beaabf459d7bf5

        • memory/1172-21-0x000001A62ED50000-0x000001A62ED72000-memory.dmp

          Filesize

          136KB

        • memory/2972-49-0x00000185EA650000-0x00000185EA66E000-memory.dmp

          Filesize

          120KB

        • memory/2972-47-0x00000185EA6B0000-0x00000185EA726000-memory.dmp

          Filesize

          472KB

        • memory/2972-86-0x00000185EA780000-0x00000185EA792000-memory.dmp

          Filesize

          72KB

        • memory/2972-85-0x00000185EA670000-0x00000185EA67A000-memory.dmp

          Filesize

          40KB

        • memory/2972-48-0x00000185EA730000-0x00000185EA780000-memory.dmp

          Filesize

          320KB

        • memory/2972-20-0x00000185E7F80000-0x00000185E7FC0000-memory.dmp

          Filesize

          256KB

        • memory/4896-3-0x00000000056B0000-0x0000000005742000-memory.dmp

          Filesize

          584KB

        • memory/4896-13-0x0000000075020000-0x00000000757D0000-memory.dmp

          Filesize

          7.7MB

        • memory/4896-7-0x0000000006390000-0x00000000065A4000-memory.dmp

          Filesize

          2.1MB

        • memory/4896-5-0x0000000005750000-0x000000000575A000-memory.dmp

          Filesize

          40KB

        • memory/4896-8-0x0000000007310000-0x00000000073C2000-memory.dmp

          Filesize

          712KB

        • memory/4896-9-0x00000000072C0000-0x00000000072E2000-memory.dmp

          Filesize

          136KB

        • memory/4896-6-0x0000000075020000-0x00000000757D0000-memory.dmp

          Filesize

          7.7MB

        • memory/4896-0-0x000000007502E000-0x000000007502F000-memory.dmp

          Filesize

          4KB

        • memory/4896-4-0x0000000005630000-0x0000000005642000-memory.dmp

          Filesize

          72KB

        • memory/4896-2-0x0000000005BC0000-0x0000000006164000-memory.dmp

          Filesize

          5.6MB

        • memory/4896-12-0x0000000007430000-0x000000000746C000-memory.dmp

          Filesize

          240KB

        • memory/4896-10-0x0000000009730000-0x0000000009A84000-memory.dmp

          Filesize

          3.3MB

        • memory/4896-1-0x0000000000C10000-0x0000000000C8A000-memory.dmp

          Filesize

          488KB

        • memory/4896-101-0x000000007502E000-0x000000007502F000-memory.dmp

          Filesize

          4KB

        • memory/4896-102-0x0000000075020000-0x00000000757D0000-memory.dmp

          Filesize

          7.7MB

        • memory/4896-103-0x0000000075020000-0x00000000757D0000-memory.dmp

          Filesize

          7.7MB